One-Way Hash Vulnerability in JetBrains Ktor Framework
CVE-2019-12737

5.3MEDIUM

Key Information:

Vendor

Jetbrains
Status
Ktor
Vendor
CVE Published:
2 October 2019

What is CVE-2019-12737?

The JetBrains Ktor framework employs a One-Way Hash with a Predictable Salt for storing user credentials, which can expose sensitive user data to risk. This vulnerability, present in versions prior to 1.2.0-rc, compromises the integrity of user authentication by allowing attackers to exploit the predictable nature of the salt, making it easier to crack hashed passwords. Organizations using affected versions should prioritize upgrading to mitigate this security risk.

References

https://blog.jetbrains.com/blog/2019/09/26/jetbrains-secu...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.