CVE-2018-5552: DocuTrac DTISQLInstaller.exe Hard-Coded Salt

Description

Versions of DocuTrac QuicDoc and Office Therapy that ship with DTISQLInstaller.exe version 1.6.4.0 and prior contains a hard-coded cryptographic salt, "S@l+&pepper".

Scores

CVSS scores of CVE-2018-5552, by who scored it
Scored by	CVSS	Score	Vector
rapid7CNA (assigner)	3.0	Low2.9	CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.0	Low3.3	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS (exploitation in 30 days): 0.21% · top 89% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.9.

Weakness

CWE-760: Use of a One-Way Hash with a Predictable Salt (CWE-760) (opens in a new tab)All about CWE-760 and its CVEs
CWE-798 (opens in a new tab)All about CWE-798 and its CVEs

Affected products

DocuTrac · DTISQLInstaller.exe
- affected unspecified – ≤ 1.6.4.0

References (1)

https://blog.rapid7.com/2018/03/14/r7-2018-01-cve-2018-5551-cve-2018-5552-docutrac-office-therapy-installer-hard-coded-credentials-and-cryptographic-salt/ (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2018-5552](https://trackcve.app/badge/CVE-2018-5552.svg)](https://trackcve.app/cve/CVE-2018-5552)

Record last updated 5 Aug 2024, 05:40 UTC.