PT-2023-5600 · Insyde · Insydeh2O

CVE-2023-31041 · Publicado 2023-08-14 · Atualizado 2023-08-24

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions InsydeH2O versions 5.0 through 5.5

Description An issue was discovered in SysPasswordDxe, where system password information could optionally be stored in cleartext, potentially leading to information disclosure. This might allow a remote attacker to access confidential information.

Recommendations For InsydeH2O versions 5.0 through 5.5, consider disabling the storage of system password information in cleartext as a temporary workaround until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

BDU:2023-06255

CVE-2023-31041

Produtos afetados

Insydeh2O

Referências · 11

• https://vuldb.com/es/?id.237079 · Nota
• https://t.me/cvenotify/57225 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1691106136278331392 · Publicação no Twitter
• https://twitter.com/TechFishNews/status/1691125984475729920 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-06255 · Nota de Segurança
• https://insyde.com/security-pledge/SA-2023047 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-31041 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-31041 · Aviso do Fabricante
• https://t.me/cvenotify/56417 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1691128614094315520 · Publicação no Twitter
• https://t.me/cibsecurity/68443 · Publicação no Telegram