PT-2023-18921 · 42Gears · 42Gears Surelock

Published 2023-04-27 · Updated 2023-05-08 · CVE-2023-2335

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions 42gears surelock windows versions 2.3.12 through 2.40.0

Description The issue allows retrieval of admin user credentials due to plaintext passwords being stored in the registry. This is related to the surelockwinsetupv2.40.0.Exe on Windows, specifically affecting registry modules.

Recommendations For versions 2.3.12 through 2.40.0, consider restricting access to the registry modules to minimize the risk of exploitation. As a temporary workaround, avoid using the affected surelockwinsetupv2.40.0.Exe until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-522

CWE-312

CWE-314

Related Identifiers

CVE-2023-2335

Affected Products

42Gears Surelock

References · 4

• https://osv.dev/vulnerability/CVE-2023-2335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2335 · Security Note
• https://42gears.com/security-and-compliance · Vendor Advisory
• https://t.me/cibsecurity/63004 · Telegram Post