Threat database

Armatura One versions prior to 4.7.2 and 4.6.1 store database and message-broker credentials in an install configuration file encrypted with AES-128-CBC using fixed keys embedded in the software. These fixed encryption keys and initialization vectors are identical across all installations, allowing an attacker with access to the installation package and the encrypted configuration file to decrypt credentials. This vulnerability is classified as CWE-321 and has a high severity with a CVSS score of 8.4.

Armatura One contains a vulnerability where its database initialization routine uses a fixed, vendor-defined password for the database superuser account instead of generating a unique password per installation. This allows anyone with operating system access and knowledge of the fixed password to authenticate as the database superuser if the password has not been changed. The vulnerability affects versions prior to 4.6.1 and 4.7.2. It has a high severity with a CVSS score of 8.4.

Armatura One versions prior to 4.7.2 and 4.6.1 have a vulnerability where the backup and restore routine logs the full database connection command, including the superuser password, in plain text on the host. This exposure allows anyone with access to the server operating system to obtain credentials and potentially access the database.

Armatura One's message broker logs client connection credentials, including passwords, in plain text during normal operation. This allows any party with read access to these logs or related backups to obtain sensitive credential information. The vulnerability is identified as CWE-532 and affects versions prior to 4.6.1 and 4.7.2. The CVSS score is 4.0, indicating a medium severity issue with low impact on confidentiality and no impact on integrity or availability.