PT-2022-15677 · Charactell · Charactell - Formstorm Enterprise

Michael Starchenko · Published 2022-01-25 · Updated 2022-02-01 · CVE-2022-22789

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Charactell - FormStorm Enterprise (affected versions not specified)

Description The issue allows an attacker to modify the passwords file for all users, enabling account takeover. The xx users.ini file in the FormStorm folder stores usernames in cleartext and an obfuscated password. An attacker can replace the existing password in the file to take over an account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-22789

Affected Products

Charactell - Formstorm Enterprise

References · 4

• https://osv.dev/vulnerability/CVE-2022-22789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22789 · Security Note
• https://t.me/cibsecurity/36256 · Telegram Post
• https://gov.il/en/departments/faq/cve_advisories · Note