CVE-2017-9615
Unknown
Last modified
CVE-2017-9615 is a vulnerability of currently unknown severity. Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file..
Description
Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file.
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Cognito | Moneyworks | <= 8.0.3 |
References
- http://cognito.co.nz/mwcommunity/viewtopic.php?f=1&t=3542Vendor Advisory
- https://gist.github.com/ari/e0dd74c12d84f102e3bcb365118e8c30Third Party Advisory, Vendor Advisory
- http://cognito.co.nz/mwcommunity/viewtopic.php?f=1&t=3542Vendor Advisory
- https://gist.github.com/ari/e0dd74c12d84f102e3bcb365118e8c30Third Party Advisory, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-9615?
Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file.
How severe is CVE-2017-9615?
Severity scoring for CVE-2017-9615 is pending analysis.
How do I fix CVE-2017-9615?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-9609Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2…
- CVE-2017-9610The xps_load_sfnt_name function in xps/xpsfont.c in Artifex …
- CVE-2017-9611The Ins_MIRP function in base/ttinterp.c in Artifex Ghostscr…7.8
- CVE-2017-9612The Ins_IP function in base/ttinterp.c in Artifex Ghostscrip…
- CVE-2017-9613Stored Cross-site scripting (XSS) vulnerability in SAP Succe…
- CVE-2017-9614The fill_input_buffer function in jdatasrc.c in libjpeg-turb…8.8
- CVE-2017-9616In Wireshark 2.2.7, overly deep mp4 chunks may cause stack e…
- CVE-2017-9617In Wireshark 2.2.7, deeply nested DAAP data may cause stack …
- CVE-2017-9618The xps_load_sfnt_name function in xps/xpsfont.c in Artifex …
- CVE-2017-9619The xps_true_callback_glyph_name function in xps/xpsttf.c in…
- CVE-2017-9620The xps_select_font_encoding function in xps/xpsfont.c in Ar…
- CVE-2017-9621Cross-site scripting (XSS) vulnerability in modules/Base/Lan…6.1
Are you affected by CVE-2017-9615?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST