Medium severity · published May 26, 2021
CVE-2019-25030
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Versa Analytics · Versa-networks
All versions, or not specified · source: NVD
VD
Versa Director · Versa-networks
All versions, or not specified · source: NVD
VO
Versa Operating System · Versa-networks
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25030
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25030
Third Party Advisory
https://hackerone.com/reports/1168197
More from Versa Analytics
7.8
CVE-2018-16497
In Versa Analytics, the cron jobs are used for scheduling tasks by executing commands at specific dates and times on the server
