I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation. Attackers are able to easily guess users' passwords via a bruteforce attack.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HI Doit
APPI-Doit≤ 25
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
Related vulnerabilities
CVE-2023-37755CRITICAL9.8PL ✓same product
i-doit: zakodowane na stałe dane logowania administratora (Auth Bypass)
CVE-2019-1010248CRITICAL9.8PL ✓same product
SQL Injection w formularzu logowania I-doit — dostęp do bazy bez uwierzytelnienia
CVE-2019-25582HIGH7.1same product
i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to down...
CVE-2019-25581HIGH8.8same product
i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi...
CVE-2024-8749HIGH8.8same product
SQL injection vulnerability in idoit pro version 28. This vulnerability could allow an attacker to send a spec...