Threats Tagged 'ghsa-rpcg-4hqj-wfv3'

Armatura One versions prior to 4.7.2 and 4.6.1 store database and message-broker credentials in an install configuration file encrypted with AES-128-CBC using fixed keys embedded in the software. These fixed encryption keys and initialization vectors are identical across all installations, allowing an attacker with access to the installation package and the encrypted configuration file to decrypt credentials. This vulnerability is classified as CWE-321 and has a high severity with a CVSS score of 8.4.