A vulnerability discovered in the official website of luxury sports car maker Ferrari could have exposed potentially sensitive information, according to a cybersecurity firm.
The issue was discovered in March by researchers at Char49, a company that provides penetration testing, auditing and training services. Ferrari addressed the weakness within a week.
The researchers noticed that the ‘media.ferrari.com’ domain is powered by WordPress and it was running a very old version of W3 Total Cache, a plugin installed on more than a million websites.
The plugin was affected by CVE-2019-6715, a flaw that can be exploited by an unauthenticated attacker to read arbitrary files. Exploitation of the vulnerability allowed the researchers to obtain the ‘wp-config.php’ file, which stores WordPress database credentials in clear text.
Char49’s David Sopas told SecurityWeek that the exposed database stored information associated with the media.ferrari.com domain.
While the researchers did not dig too deep in order to avoid breaking responsible disclosure rules, Sopas noted that the vulnerability could have been exploited to access other files on the web server, including ones that could contain information that is of value for threat actors.
After being notified, Ferrari patched the vulnerability by updating the WordPress plugin.
While in this case there is no indication that the security hole directly exposed customer or other sensitive information, it’s important for high-profile companies such as Ferrari to ensure that none of their systems are vulnerable.
In March, Ferrari admitted being targeted in a ransomware attack in which hackers stole customer information.
Related: Thieves Use CAN Injection Hack to Steal Cars
Related: 16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure
Related: Several Car Brands Exposed to Hacking by Flaw in Sirius XM Connected Vehicle Service
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
