CVE-2024-1344 MEDIUM

CVE-2024-1344: Encrypted database credentials in LaborOfficeFree

Vendor Laborofficefree
Product LaborOfficeFree
Weakness CWE-798 · Hardcoded credentials
Published February 19, 2024
Last update August 19, 2024
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Local
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

What the vulnerability does

01Description

Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\LaborOfficeFree\' directory. This user can log in remotely and has root-like privileges.

Key dates

02Disclosure timeline

February 19, 2024 CVE published
August 19, 2024 Record updated