vulnwire
2.9low

CVE-2018-5552

DocuTrac DTISQLInstaller.exe Hard-Coded Salt

Published 8 y ago · modified 4 mo ago · JSON

CVSS
2.9
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 11%
Public exploits
0
none known

Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pepper".

Exploit prediction (EPSS)

0.21% probability of exploitation in the next 30 days, higher than 11% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.02.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA3.02.9CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD3.03.3CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • DocuTrac DTISQLInstaller.exe

Classification

Weakness
  • CWE-760 Use of a One-Way Hash with a Predictable Salt
  • CWE-798 Use of Hard-coded Credentials

References

  • blog.rapid7.com /2018/03/14/r7-2018-01-cve-2018-5551-cve-2018-5552-docutrac-office-therapy-installer-hard- · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.