|CVSS SCORE||6.5, (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)|
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Red Lion Crimson. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the CTextStreamMemory class. The class contains hard-coded secrets in clear text. An attacker can leverage this to decrypt user passwords.
Red Lion has issued an update to correct this vulnerability. More details can be found at:
|CREDIT||Michael DePlante, Anthony Fuller and Todd Manning of Trend Micro Zero Day Initiative/Trend Micro Research