CVE-2014-2354

Published: May 30, 2014Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Cogent DataHub before 7.3.5 does not use a salt during password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.

Affected (12)

Products: Cogentdatahub: Cogent Datahub

Cogentdatahub

1 product

Cogent Datahub

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Cogentdatahub Cogent Datahub	Up to 7.3.4
Cogentdatahub Cogent Datahub	Version 7.0.2
Cogentdatahub Cogent Datahub	Version 7.0
Cogentdatahub Cogent Datahub	Version 7.1.0
Cogentdatahub Cogent Datahub	Version 7.1.1.63
Cogentdatahub Cogent Datahub	Version 7.1.1
Cogentdatahub Cogent Datahub	Version 7.1.2
Cogentdatahub Cogent Datahub	Version 7.2.2
Cogentdatahub Cogent Datahub	Version 7.3.0
Cogentdatahub Cogent Datahub	Version 7.3.1
Cogentdatahub Cogent Datahub	Version 7.3.2
Cogentdatahub Cogent Datahub	Version 7.3.3

Related CWEs

CWE-255

CWE-916

Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (3)

http://cogentdatahub.com/Download_Software.html

Source: ics-cert@hq.dhs.gov

https://www.cisa.gov/news-events/ics-advisories/icsa-14-149-02

Source: ics-cert@hq.dhs.gov

http://ics-cert.us-cert.gov/advisories/ICSA-14-149-02

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

Timeline

No history available yet.