{"id":24827,"date":"2021-08-17T15:20:16","date_gmt":"2021-08-17T13:20:16","guid":{"rendered":"https:\/\/www.tranquil.it\/wapt-discovery-of-a-security-breach\/"},"modified":"2025-07-17T17:09:25","modified_gmt":"2025-07-17T15:09:25","slug":"wapt-discovery-of-a-security-breach","status":"publish","type":"post","link":"https:\/\/www.tranquil.it\/en\/wapt-discovery-of-a-security-breach\/","title":{"rendered":"WAPT : Discovery of a security breach"},"content":{"rendered":"

[et_pb_section fb_built=”1″ _builder_version=”4.27.4″ background_color=”#009EBD” background_enable_image=”off” custom_margin=”0px||0px||true” custom_padding=”27px||27px||true|” hover_enabled=”0″ global_colors_info=”{}” sticky_enabled=”0″][et_pb_row _builder_version=”4.16″ custom_margin=”0px||0px||true|false” custom_padding=”40px||40px||true|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_post_title featured_image=”off” text_color=”light” _builder_version=”4.27.4″ text_orientation=”center” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” hover_enabled=”0″ global_colors_info=”{}” meta=”off” sticky_enabled=”0″][\/et_pb_post_title][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”][et_pb_row _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”60px||0px||false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”]<\/p>\n

Recently, we were contacted by an organization informing us about the discovery of a significant security vulnerability<\/strong> related to WAPT<\/a>. Find all the important details in this article, including the fix for the vulnerability<\/a>.<\/p>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”][et_pb_row _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”50px||0px||false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”]<\/p>\n

The security breach in WAPT<\/span><\/h2>\n

[\/et_pb_text][\/et_pb_column][\/et_pb_row][et_pb_row column_structure=”1_2,1_2″ _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”][et_pb_column type=”1_2″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”]<\/p>\n

During a Red Team mission, the ITT&AC (Independent Technical & Automation Center) team at BNP Paribas discovered a security vulnerability. This vulnerability, identified by “Anass Annour from the Risk ORM\/ITT&AC team at BNP Paribas,” was previously unknown (Zero Day).<\/p>\n

This vulnerability allows users to elevate their privileges via the WAPT agent<\/strong>. For obvious security reasons, we cannot disclose more details about the nature or operation of this flaw.<\/p>\n

We want to emphasize that this vulnerability is significant<\/strong> and needs to be addressed promptly<\/strong>. You can refer to the CVSS score<\/a> of this vulnerability for more information.<\/p>\n

[\/et_pb_text][\/et_pb_column][et_pb_column type=”1_2″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_image src=”https:\/\/www.tranquil.it\/wp-content\/uploads\/screen_score_cvss.png” alt=”CVSS score of the WAPT security breach” title_text=”screen_score_cvss” _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”][\/et_pb_image][\/et_pb_column][\/et_pb_row][et_pb_row _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”30px||0px||false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”]<\/p>\n

In the field of cybersecurity, the CVSS score allows the standardized evaluation, based on objective and measurable criteria, of the criticality of a vulnerability<\/strong>. CVSS stands for Common Vulnerability Scoring System. This assessment is based on three precise metrics:<\/p>\n

    \n
  1. The Base Metric.<\/li>\n
  2. The Temporal Metric.<\/li>\n
  3. The Environmental Metric.<\/li>\n<\/ol>\n

    [\/et_pb_text][et_pb_text _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”]<\/p>\n

    What is a Red Team?<\/h3>\n

    A Red Team is a team whose objective is to test the cybersecurity of your systems by attempting to hack them<\/strong>. Its members simulate malicious attacks aimed at penetrating<\/strong> the systems they are tasked to study. These actions are carried out in a benevolent and preventive manner<\/strong>, aiming to identify vulnerabilities<\/strong> so that they can be addressed as quickly as possible<\/strong>. Red Teams are often contrasted with Blue Teams or even Purple Teams, each having different objectives and operational methods.<\/p>\n

    [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section][et_pb_section fb_built=”1″ _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”][et_pb_row module_id=”correctif” _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”50px||0px||false|false” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ _module_preset=”default” global_colors_info=”{}”][et_pb_text _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”]<\/p>\n

    Quickly fix the security breach<\/span><\/h2>\n

    [\/et_pb_text][et_pb_text _builder_version=”4.16″ _module_preset=”default” custom_margin=”0px||0px||true|false” custom_padding=”0px||0px||true|false” global_colors_info=”{}”]<\/p>\n

    We are now able to provide a patch<\/strong> to address this security vulnerability. Therefore, we can communicate about it in accordance with the “responsible disclosure” process.<\/p>\n

    The patch is straightforward to implement as you simply need to update WAPT<\/a>. Two versions are available<\/strong> to facilitate this process:<\/p>\n