Vulnerabilities > CVE-2022-37163 - Use of Password Hash With Insufficient Computational Effort vulnerability in Ihatetobudget Project Ihatetobudget 1.5.7
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Bminusl IHateToBudget v1.5.7 employs a weak password policy which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. Additionally, user passwords are hashed without a salt or pepper making it much easier for tools like hashcat to crack the hashes.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |