CVE-2024-38881

Description

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow Table Password cracking attack due to the use of one-way hashes without salts when storing user passwords.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-760 CWE-760

Affected Products

Vendor	Product	Versions
horizoncloud	caterease	16.0.1.1663 — 24.0.1.2405

References

Other References

http://caterease.com http://horizon.com https://packetstormsecurity.com/files/179892/Caterease-Software-SQL-Injection-Command-Injection-Bypass.html https://vuldb.com/?id.273365

Frequently Asked Questions

What is CVE-2024-38881? +

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Rainbow Table Password cracking attack due to the use of one-way hashes without salts when storing user passwords. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-38881? +

CVE-2024-38881 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-38881? +

CVE-2024-38881 affects products from horizoncloud, specifically: caterease. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-38881? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-13951 7.6

One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: …

CVE-2026-46749 7.5

A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 6). The affected application uses a …

CVE-2025-26486 6.0

Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a …

CVE-2026-9370 3.7

A weakness has been identified in ulisesbocchio jasypt-spring-boot up to 3.0.5/4.0.4. Affected by this vulnerability is the function getSecretKeySaltGenerator of …

CVE-2024-38882 9.8

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to …

CVE-2024-38886 9.8