CVE-2024-1344CWE-798

Encrypted database credentials in LaborOfficeFree

Medium · published February 19, 2024

CVSS v3.1
6.8
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%\LaborOfficeFree\' directory. This user can log in remotely and has root-like privileges.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00305 · 22.0th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2024-02-19T11:19Z
EPSS history
Timeline
  • 19 FEB 11:19Z
    Encrypted database credentials in LaborOfficeFree
    cvelistv5