← Back

CVE-2017-11131

nvd nist
Published: Aug 1, 2017Modified: May 13, 2026

JSON object

Loading...
5.9
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.2 / Impact: 3.6
Source: NVD

Description

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authentication. Moreover, only the first 32 bytes of the hash are used. This allows for easy dictionary and rainbow-table attacks if an attacker has access to the password hash.

Affected (3)

Stashcat
1 product
Heinekingmedia
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Heinekingmedia
Up to 1.7.5
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Heinekingmedia
Up to 0.0.80w
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Heinekingmedia
Up to 0.0.86w

Related CWEs

CWE-916
Use of Password Hash With Insufficient Computational Effort
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

References (2)

Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory

Timeline

No history available yet.