SB2026061996 - Multiple vulnerabilities in Crucible Data Center and Crucible Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026061996

SB2026061996 - Multiple vulnerabilities in Crucible Data Center and Crucible Server

Published: June 19, 2026

Security Bulletin ID SB2026061996
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2025-22228)

CWE-ID: CWE-254 - Security Features

CVSSv4: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to BCryptPasswordEncoder does not properly enforce maximum password length and will return "true" for passwords larger than 72 characters as long as the first 72 characters are the same. This can be used set weak passwords that can be easily brute-forced.


2) Credentials management (CVE-ID: CVE-2019-11272)

CWE-ID: CWE-255 - Credentials Management

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to gain unauthorized access to a system.

The vulnerability exist due to the PlaintextPasswordEncoder uses plain text passwords. A local user can bypass authentication process using a password of "null" and gain unauthorized access to the targeted system.

3) Improper access control (CVE-ID: CVE-2024-22257)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions when the "AuthenticatedVoter#vote" passing a "null" Authentication parameter. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.


Remediation

Install update from vendor's website.

References