CVE-2017-1000192

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, private encryption key, as well as other sensitive information.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-11-17

Last modified

2024-09-16

Affected products

• Syspass (Cygnux)

References

• https://github.com/nuxsmin/sysPass/releases/tag/2.1.8.17042901