Galaxy Software Services Vitals ESP is vulnerable to using a hard-coded encryption key. An unauthenticated remote attacker can generate a valid token parameter and exploit this vulnerability to access system to operate processes and access data.
This issue affects Vitals ESP: from 3.0.8 through 6.2.0.
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vitals_enterprise_social_platform | Gss | 3.0.8 (including) | 6.2.0 (including) |