Dreryk Gabinet
Monthly
Hard-coded API credentials embedded in DrEryk Gabinet's ticket reporting component allow any network-accessible attacker to authenticate directly to the ticket system API in versions before 11.5.0. Once the static credentials are known - through reverse engineering or public disclosure by CERT-PL - an attacker can perform privileged ticket operations including reading and modifying records beyond what the application's own permission model permits. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 11.5.0.
Hard-coded API credentials embedded in DrEryk Gabinet's ticket reporting component allow any network-accessible attacker to authenticate directly to the ticket system API in versions before 11.5.0. Once the static credentials are known - through reverse engineering or public disclosure by CERT-PL - an attacker can perform privileged ticket operations including reading and modifying records beyond what the application's own permission model permits. No public exploit code or active exploitation has been identified at time of analysis; the fix is available in version 11.5.0.