PT-2022-6952 · Unknown · Qms Automotive

Published 2022-11-08 · Updated 2023-09-12 · CVE-2022-43958

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions QMS Automotive versions prior to V12.39

Description The issue is related to the storage of critical information in plaintext, which could allow a remote attacker to disclose user credentials. This may enable the attacker to gain access to credentials and impersonate other users. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to V12.39, update to version V12.39 or later to resolve the issue. As a temporary workaround, consider restricting access to the database to minimize the risk of exploitation. Avoid using plaintext storage for user credentials until the issue is resolved.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

CWE-256

Related Identifiers

BDU:2023-05773

CVE-2022-43958

Affected Products

Qms Automotive

References · 6

• https://bdu.fstec.ru/vul/2023-05773 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-587547.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43958 · Security Note
• https://t.me/cvenotify/37386 · Telegram Post
• https://t.me/cibsecurity/52623 · Telegram Post
• https://cert-portal.siemens.com/productcert/pdf/ssa-147266.pdf · Note