A vulnerability discovered in the official website of luxury sports car maker Ferrari could have exposed potentially sensitive information, according to a cybersecurity firm.
The issue was discovered in March by researchers at Char49, a company that provides penetration testing, auditing and training services. Ferrari addressed the weakness within a week.
The researchers noticed that the ‘media.ferrari.com’ domain is powered by WordPress and it was running a very old version of W3 Total Cache, a plugin installed on more than a million websites.
The plugin was affected by CVE-2019-6715, a flaw that can be exploited by an unauthenticated attacker to read arbitrary files. Exploitation of the vulnerability allowed the researchers to obtain the ‘wp-config.php’ file, which stores WordPress database credentials in clear text.
Char49’s David Sopas told SecurityWeek that the exposed database stored information associated with the media.ferrari.com domain.
While the researchers did not dig too deep in order to avoid breaking responsible disclosure rules, Sopas noted that the vulnerability could have been exploited to access other files on the web server, including ones that could contain information that is of value for threat actors.
After being notified, Ferrari patched the vulnerability by updating the WordPress plugin.
While in this case there is no indication that the security hole directly exposed customer or other sensitive information, it’s important for high-profile companies such as Ferrari to ensure that none of their systems are vulnerable.
In March, Ferrari admitted being targeted in a ransomware attack in which hackers stole customer information.
Related: Thieves Use CAN Injection Hack to Steal Cars
Related: 16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure
Related: Several Car Brands Exposed to Hacking by Flaw in Sirius XM Connected Vehicle Service
