Description

In Rukovoditel 2.5.2, users' passwords and usernames are stored in a cookie with URL encoding, base64 encoding, and hashing. Thus, an attacker can easily apply brute force on them.

Remediation

References

CVE-2020-11821

Related Vulnerabilities

IBM WebSEAL Use of a Broken or Risky Cryptographic Algorithm Vulnerability (CVE-2023-38371)

Oracle Application Server CVE-2006-3706 Vulnerability (CVE-2006-3706)

Django Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2021-28658)

e107 Other Vulnerability (CVE-2005-4224)

Nginx Other Vulnerability (CVE-2016-0742)

Severity

Medium

Classification

CVE-2020-11821 CWE-312 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities