CVE-2026-107829highCWE-916

CVE-2026-107829: fallo de gravedad alta en banq jivejdon

Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql

Publicada el

18Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
banq · jivejdon
CVEs relacionadas — banq jivejdon

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-107831MEDIUMJivejdon through 5.0 CSRF via GET-based Account and Thread ActionsEPSS —CVE-2026-107830MEDIUMJivejdon through commit ee67a65e Missing Rate Limiting via /account/smsVRAction SMS EndpointEPSS —CVE-2026-107828MEDIUMJivejdon through 5.0 Predictable Passwords via Sina Weibo OAuth LoginEPSS —CVE-2026-107801MEDIUMJivejdon through 5.0 Stored XSS via Attachment Upload Content-TypeEPSS —CVE-2026-107800MEDIUMJivejdon through 5.0 Stored XSS via Private Short MessagesEPSS —CVE-2026-107799MEDIUMJivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message RenderingEPSS —
Referencias
https://github.com/banq/jivejdonhttps://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/auth/jaas/DigestUtil.java#L30-L44https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/auth/jaas/JiveJdonLoginMoudle.java#L86https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java#L181https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/infrastructure/repository/dao/sql/AccountDaoSql.java#L253https://github.com/banq/jivejdon/blob/ee67a65e65228644a71c8317d7e34deea50f95ef/src/main/java/com/jdon/jivejdon/util/ToolsUtil.java#L198-L211https://github.com/banq/jivejdon/issues/28https://www.vulncheck.com/advisories/jivejdon-through-5.0-unsalted-md5-password-storage-via-accountdaosql