Sandboxie-Plus, an open source sandbox isolation software for Windows, in versions prior to 1.17.3, improperly converts SHA-1 password hashes by shifting the high nibble incorrectly, resulting in stored password hashes that only preserve the low nibble of each digest byte. This reduces the effective entropy from 160 bits to 80 bits on top of using an unsalted SHA-1 scheme, weakening password hash strength and making brute-force attacks easier. The vulnerability is identified as CWE-328 (Use of Weak Hash). The flaw was corrected in version 1.17.3.

The reduced entropy in password hashes lowers the computational effort required to brute-force passwords if hashes are leaked or backed up. However, the overall impact is limited due to the local attack vector and the requirement for privileged access to obtain the hashes. There are no known exploits in the wild. The CVSS score of 2 (low severity) reflects the limited attack surface and difficulty of exploitation.

Upgrade Sandboxie-Plus to version 1.17.3 or later, where the password hashing issue has been fixed. Since the vendor advisory does not provide additional remediation details, applying this update is the recommended action. Patch status is not explicitly stated but the fix is included in version 1.17.3.