Attacker Value
Unknown
CVE-2020-28052
CVE-2020-28052
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
8.1 High
Impact Score:
5.9
Exploitability Score:
2.2
Attack Vector (AV):
Network
Attack Complexity (AC):
High
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High
General Information
Vendors
- apache,
- bouncycastle,
- oracle
Products
- banking corporate lending process management 14.2.0,
- banking corporate lending process management 14.3.0,
- banking corporate lending process management 14.5.0,
- banking credit facilities process management 14.2.0,
- banking credit facilities process management 14.3.0,
- banking credit facilities process management 14.5.0,
- banking extensibility workbench 14.2.0,
- banking extensibility workbench 14.3.0,
- banking extensibility workbench 14.5.0,
- banking supply chain finance 14.2.0,
- banking supply chain finance 14.3.0,
- banking supply chain finance 14.5.0,
- banking virtual account management 14.2.0,
- banking virtual account management 14.3.0,
- banking virtual account management 14.5.0,
- blockchain platform,
- commerce guided search 11.3.2,
- communications application session controller 3.9m0p3,
- communications cloud native core network slice selection function 1.2.1,
- communications convergence 3.0.2.2.0,
- communications messaging server 8.0.2,
- communications messaging server 8.1,
- communications pricing design center 12.0.0.3.0,
- communications session report manager,
- communications session route manager,
- jd edwards enterpriseone tools,
- karaf 4.3.2,
- legion-of-the-bouncy-castle-java-crytography-api 1.65,
- legion-of-the-bouncy-castle-java-crytography-api 1.66,
- peoplesoft enterprise peopletools 8.56,
- peoplesoft enterprise peopletools 8.57,
- peoplesoft enterprise peopletools 8.58,
- utilities framework 4.3.0.6.0,
- utilities framework 4.4.0.0.0,
- utilities framework 4.4.0.2.0,
- utilities framework 4.4.0.3.0,
- webcenter portal 11.1.1.9.0,
- webcenter portal 12.2.1.3.0,
- webcenter portal 12.2.1.4.0
References
Advisory
Miscellaneous
