Main Vulnerability Database Vulnerabilities #VU28179

Cleartext storage of sensitive information in Software House C•CURE 9000 and American Dynamics victor Video Management System - CVE-2020-9045

Published: May 22, 2020

Vulnerability identifier: #VU28179

CSH Severity: Medium

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-9045

CWE-ID: CWE-312

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to view the password on the target system.

The vulnerability exists due to the credentials of the user performing the installation or upgrade are saved in a file. A remote authenticated attacker can obtain this credential because the install log file persists after the installation.

Affected software

Software House C•CURE 9000
American Dynamics victor Video Management System

How to mitigate CVE-2020-9045

Install updates from vendor's website.

Software House C•CURE 9000 - update to 2.80
American Dynamics victor Video Management System - update to 5.3

External References

Related Security Bulletins