Simple SA SIMPLE.ERP up to 6.30 password recoverable

Summaryinfo

A vulnerability was found in Simple SA SIMPLE.ERP up to 6.30. It has been rated as problematic. This issue affects some unknown processing. The manipulation leads to password recoverable. This vulnerability is referenced as CVE-2024-8774. Remote exploitation of the attack is possible. No exploit is available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Simple SA SIMPLE.ERP up to 6.30. This issue affects an unknown function. The manipulation with an unknown input leads to a password recoverable vulnerability. Using CWE to declare the problem leads to CWE-257. The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts. Impacted is confidentiality. The summary by CVE is:

The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch [email protected], which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.

The weakness was published by Dr Inż. Marcin Ochab. It is possible to read the advisory at cert.pl. The identification of this vulnerability is CVE-2024-8774 since 09/13/2024. The exploitation is known to be difficult. The attack may be initiated remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Applying the patch [email protected] is able to eliminate this problem.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Enterprise Resource Planning Software

Vendor

• Simple SA

Name

• SIMPLE.ERP

Version

• 6.0
• 6.1
• 6.2
• 6.3
• 6.4
• 6.5
• 6.6
• 6.7
• 6.8
• 6.9
• 6.10
• 6.11
• 6.12
• 6.13
• 6.14
• 6.15
• 6.16
• 6.17
• 6.18
• 6.19
• 6.20
• 6.21
• 6.22
• 6.23
• 6.24
• 6.25
• 6.26
• 6.27
• 6.28
• 6.29
• 6.30

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion