#VU33357 Missing Encryption of Sensitive Data - CVE-2019-16062

Vulnerability identifier: #VU33357

Vulnerability risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-16062

CWE-ID: CWE-311

Exploitation vector: Network

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

NETSAS Enigma NMS 65.0.0 and prior does not encrypt sensitive data stored within the SQL database. It is possible for an attacker to expose unencrypted sensitive data.

Mitigation
Install update from vendor's website.

External links
https://www.mogozobo.com/?p=3647

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.