What is CVE-2017-11131?

CVE-2017-11131 is a medium-severity vulnerability in Stashcat Heinekingmedia, classified under Use of Password Hash With Insufficient Computational Effort. CVSS score: 5.9/10. Published 2017-08-01.

How severe is CVE-2017-11131?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Vulnerability in Stashcat Heinekingmedia

CVE-2017-11131

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authentication. Moreover, only the first 32 bytes of the hash are used. This allows for easy dictionary and rainbow-table attacks if an attacker has access to the password hash.

EPSS: 0.005 (42.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Stashcat Heinekingmedia
N/a — versions n/a

Weakness classification (CWE)

CWE-916 — Use of Password Hash With Insufficient Computational Effort

References

cve@mitre.org (Mailing List, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2017-11131?: CVE-2017-11131 is a medium-severity vulnerability in Stashcat Heinekingmedia, classified under Use of Password Hash With Insufficient Computational Effort. CVSS score: 5.9/10. Published 2017-08-01.
How severe is CVE-2017-11131?: Medium severity. CVSS v3 base score is 5.9 out of 10.