Vulnerability in Hauk Project
CVE-2022-37857
bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-side as well as in clear-text on the android client device by default.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (39.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 40th percentile — 39.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.001
Affected products
- Hauk Project — versions 1.6.1
Weakness classification (CWE)
References
- gainsec.com/2022/08/07/cve-2022-hardcoded-creds-weak-password-hauk-android-loca… (Third Party Advisory)
- github.com/bilde2910/Hauk/issues/187 (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2022-37857?
- CVE-2022-37857 is a high-severity vulnerability in Hauk Project, classified under Cleartext Storage of Sensitive Information. CVSS score: 7.5/10. Published 2022-09-08.
- How severe is CVE-2022-37857?
- High severity. CVSS v3 base score is 7.5 out of 10.