CyberSecBulletin

Objectfirst vulnerabilities

We track 2 vulnerabilities in Objectfirst products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 7, 2022.

2vulnerabilities
1critical
1high
0exploited
9.3average CVSS score

Latest Objectfirst vulnerabilities

  • 9.8 Critical severity

    Ootbi: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

    CVE-2022-44796Objectfirst

    An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function tha

  • 8.8 High severity

    Ootbi: Improper Control of Generation of Code

    CVE-2022-44794ObjectfirstEPSS 1.15%

    An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash code with root privileges. The command that sets the hostname doesn't validate input parameters. As a re