CVE-2020-14489

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

OpenClinic GA 5.09.02 and 5.89.05b stores passwords using inadequate hashing complexity, which may allow an attacker to recover passwords using known password cracking techniques.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
open source	OpenClinic GA	5.09.02; 5.89.05b

References

https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/ICSMA-20-184-01Third Party Advisory, US Government Resource

Timeline

Published: Jul 29, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-14497.8A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka CVE-2020-144908.8OpenClinic GA 5.09.02 and 5.89.05b includes arbitrary local files specified within its parameter and executes some files, which may allow di CVE-2020-144916.5OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege CVE-2020-144926.1OpenClinic GA 5.09.02 and 5.89.05b does not properly neutralize user-controllable input, which may allow the execution of malicious code wit CVE-2020-144938.8A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execu CVE-2020-144949.8OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexit CVE-2020-144969.8Successful exploitation of this vulnerability for multiple Mitsubishi Electric Factory Automation Engineering Software Products of various v CVE-2020-144979.8Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-contr CVE-2020-1449810.0HMS Industrial Networks AB eCatcher all versions prior to 6.5.5 is vulnerable to a stack-based buffer overflow, which may allow an attacker CVE-2020-144997.5Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may all CVE-2020-14505.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2020-145009.8Secomea GateManager all versions prior to 9.2c, An attacker can send a negative value and overwrite arbitrary data.