CVE-2025-2265 Details
Description
The password of a web user in "Sante PACS Server.exe" is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table in the SQLite database HTTP.db. However, the number of hash bytes encoded and stored is truncated if the hash contains a zero byte
A vulnerability exists in Sante PACS Server 4.1.0, where the password of a web user is processed in a way that leads to hash truncation. The password is zero-padded to 0x2000 bytes, SHA1-hashed, base64-encoded, and stored in the USER table of the SQLite database HTTP.db. However, if the hash contains a zero byte, the encoded and stored hash length is truncated, creating a potential for hash collision attacks. An unauthenticated remote attacker can exploit this vulnerability by leveraging a path traversal vulnerability to download the HTTP.db file and find a user with a truncated password hash, then calculate the corresponding password equivalent.
Users are advised to upgrade to Sante PACS Server version 4.2.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Mar 13, 2025CISA-ADP
Assessed Mar 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.tenable.com/security/research/tra-2025-08 | [email protected] | AdvisoryBundleExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sante PACS Server | 4.1.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 13, 2025 | New CVE Received | [email protected] |