CVE-2017-5999 - CVE House
Back to Database
Status published High CVE-2017-5999

An issue was discovered in sysPass 2.x before 2.1, in...

Vulnerability Description

An issue was discovered in sysPass 2.x before 2.1, in which an algorithm was never sufficiently reviewed by cryptographers. The fact that inc/SP/Core/Crypt.class is using the MCRYPT_RIJNDAEL_256() function (the 256-bit block version of Rijndael, not AES) instead of MCRYPT_RIJNDAEL_128 (real AES) could help an attacker to create unknown havoc in the remote system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-5999

Credits & Attribution

No credits recorded in the NVD database.

References

More from syspass

View All →
CVE-2017-9306
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the...
Medium 6.1

Affected Vendor

Affected Software

syspass
Vulnerable Versions:
2.0

Timeline

Official Publish: March 6th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.