Weak passwords allowed in cloudexplorer-lite

Vulnerability

CloudExplorer-Lite versions prior to 1.2.0 do not enforce strong password policies on the backend. The password change function fails to validate password strength, allowing users to set weak passwords such as a single character "1" or reuse the old password. This affects all versions before 1.2.0 [1].

Exploitation

An attacker with network access to the CloudExplorer-Lite web interface can attempt to brute-force user accounts due to the lack of password complexity requirements. Additionally, a legitimate user can set an extremely weak password, making their account vulnerable to guessing attacks. No special privileges are required beyond normal user access to the password change function [1].

Impact

Successful exploitation allows an attacker to gain unauthorized access to user accounts by guessing or brute-forcing weak passwords. This can lead to compromise of the entire system, as the attacker may escalate privileges or access sensitive cloud resources managed by CloudExplorer-Lite [1].

Mitigation

The vulnerability is fixed in version 1.2.0. Users should upgrade to this version immediately. There are no known workarounds for this vulnerability [1].