Juggleim
Monthly
Weak password hashing in JuggleIM im-server and its imserver-console through 1.8.16 stores admin-console credentials as unsalted SHA-1 digests in the accounts table, allowing an attacker who first obtains the database or its backups to crack those passwords offline with precomputed rainbow tables or GPU brute force. The issue is conditional rather than directly network-reachable, because it requires prior read access to the database or backup files, and no public exploit identified at time of analysis. The independent assessment rates it a moderate, conditional risk with high attack complexity and confidentiality-only impact.
Hard-coded administrator credentials (admin/123456) shipped in JuggleIM im-server through version 1.8.16 allow unauthenticated remote attackers to log in to the admin console exposed on TCP port 8090 and take control of tenant applications and their application secrets. Because the console's CheckLogin routine recreates the admin account whenever it is absent, deleting the default administrator does not remove the exposure - the account simply returns. Exploitation requires only that port 8090 is network-reachable and that the operator has not rotated the shipped password; no public exploit code was identified at time of analysis, although the vendor advisory, a public technical writeup, and the upstream SQL seed and login source are all publicly referenced.
Weak password hashing in JuggleIM im-server and its imserver-console through 1.8.16 stores admin-console credentials as unsalted SHA-1 digests in the accounts table, allowing an attacker who first obtains the database or its backups to crack those passwords offline with precomputed rainbow tables or GPU brute force. The issue is conditional rather than directly network-reachable, because it requires prior read access to the database or backup files, and no public exploit identified at time of analysis. The independent assessment rates it a moderate, conditional risk with high attack complexity and confidentiality-only impact.
Hard-coded administrator credentials (admin/123456) shipped in JuggleIM im-server through version 1.8.16 allow unauthenticated remote attackers to log in to the admin console exposed on TCP port 8090 and take control of tenant applications and their application secrets. Because the console's CheckLogin routine recreates the admin account whenever it is absent, deleting the default administrator does not remove the exposure - the account simply returns. Exploitation requires only that port 8090 is network-reachable and that the operator has not rotated the shipped password; no public exploit code was identified at time of analysis, although the vendor advisory, a public technical writeup, and the upstream SQL seed and login source are all publicly referenced.