MaxKB Weak Password Hashing Vulnerability Allowing Easy Cracking

A vulnerability exists in MaxKB versions prior to 2.9.1, where user passwords are hashed using unsalted MD5. This weak hashing method allows passwords to be easily cracked using rainbow tables or through GPU-accelerated brute force attacks with tools like hashcat. The vulnerability arises because the absence of salt means that identical passwords generate the same hash, making them susceptible to rapid cracking. This issue has been addressed in version 2.9.1.

Impact

The vulnerability allows for easy cracking of user passwords, potentially leading to unauthorized access.

Remediation

Users can upgrade to MaxKB version 2.9.1 to address this vulnerability.