CVE-2024-25102 HIGH

CVE-2024-25102: Information Disclosure Vulnerability in CDAC AppSamvid Software

Vendor Cdac
Product AppSamvid Software
Weakness CWE-326 · Weak encryption
Published March 6, 2024
Last update September 23, 2024

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

This vulnerability exists in AppSamvid software due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. An attacker with local administrative privileges could exploit this to obtain the password of AppSamvid on the targeted system. Successful exploitation of this vulnerability could allow the attacker to take complete control of the application on the targeted system.

Key dates

02Disclosure timeline

March 6, 2024 CVE published
September 23, 2024 Record updated