CVE-2019-25030
First published: Wed May 26 2021(Updated: )
In Versa Director, Versa Analytics and VOS, Passwords are not hashed using an adaptive cryptographic hash function or key derivation function prior to storage. Popular hashing algorithms based on the Merkle-Damgardconstruction (such as MD5 and SHA-1) alone are insufficient in thwarting password cracking. Attackers can generate and use precomputed hashes for all possible password character combinations (commonly referred to as "rainbow tables") relatively quickly. The use of adaptive hashing algorithms such asscryptorbcryptor Key-Derivation Functions (i.e.PBKDF2) to hash passwords make generation of such rainbow tables computationally infeasible.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Versa Networks Versa Analytics | ||
| Versa Networks Versa Director | ||
| Versa Networks Versa Operating System |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-25030?
CVE-2019-25030 has a high severity due to the inadequate password storage mechanisms that can lead to unauthorized access.
How do I fix CVE-2019-25030?
To fix CVE-2019-25030, implement a secure password hashing algorithm that uses an adaptive cryptographic hash function.
Which software versions are affected by CVE-2019-25030?
CVE-2019-25030 affects various versions of Versa Analytics, Versa Director, and the Versa Operating System.
What risks are associated with CVE-2019-25030?
The risks associated with CVE-2019-25030 include potential exposure of user passwords and unauthorized account access.
Is CVE-2019-25030 being actively exploited?
While there are no confirmed reports of exploitation for CVE-2019-25030, its vulnerabilities make it a likely target for attackers.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/versa-networks
- canonical/versa networks versa analytics
- canonical/versa networks versa director
- canonical/versa networks versa operating system