Software Vulnerabilities Used by 200 VT Towns Left Employees’ SSNs Exposed

guest · Feb 6, 2019

Software Vulnerabilities Used by 200 VT Towns Left Employees’ SSNs Exposed
February 6, 2019
https://www.tripwire.com/state-of-s...-by-200-vt-towns-left-employees-ssns-exposed/

Vulnerabilities in software used by 200 Vermont municipalities left town employees’ Social Security Numbers and other information exposed.
Brett Johnson, owner of IT company simpleroute, discovered the flaws after two Vermont towns hired him to do some work for them back in 2017.

According to a report in which he wrote about the weaknesses, Johnson said that the vulnerabilities affected the New England Municipal Resource Center (NEMRC) software, which approximately 200 municipalities in Vermont use to store vital data including marriage licenses and tax payment information.

The problem is that any users of NEMRC requires full access to the files on the server for the client-side frontend to work properly, thereby elevating the risk of unintended data access. In one file, for instance, Johnson found it was possible for someone to obtain a plaintext file of municipal workers’ Social Security Numbers.
He also found that the NEMRC cloud backup service used a FTP transport mechanism that didn’t employ any encryption.
Click to expand...

Vulnerability Disclosure Report (PDF): https://ja3ga476chj1nc6csy2j81c7-wpengine.netdna-ssl.com/wp-content/uploads/2019/02/Vulnerability-Disclosure.pdf

Log in or Sign up

Software Vulnerabilities Used by 200 VT Towns Left Employees’ SSNs Exposed

guest Guest

Log in or Sign up

Software Vulnerabilities Used by 200 VT Towns Left Employees’ SSNs Exposed

guest Guest

Useful Searches