CVE-2023-33243 - RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password

Back Back to CVE browser

HIGH

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password

Published Jun 15, 2023

8.1

HIGH

CVSS 3.1

EPSS 4.42%

Description

RedTeam Pentesting discovered that the web interface of STARFACE as well as its REST API allows authentication using the SHA512 hash of the password instead of the cleartext password. While storing password hashes instead of cleartext passwords in an application's database generally has become best practice to protect users' passwords in case of a database compromise, this is rendered ineffective when allowing to authenticate using the password hash.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-916

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-37412
Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible
ExploitThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-37412		Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses		Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2022-004/-starface-authentication-with-password-hash-possible		ExploitThird Party Advisory