PT-2023-27144 · Fujitsu · Fujitsu Software Infrastructure Manager

Published 2023-08-07 · Updated 2023-08-11 · CVE-2023-39903

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Fujitsu Software Infrastructure Manager (ISM) versions prior to 2.8.0.061

Description An issue in the ismsnap component of Fujitsu Software Infrastructure Manager (ISM) allows insecure collection and storage of authorization credentials in cleartext. This occurs when users perform ISM Firmware Repository Address setup tests or regularly authorize against a configured remote firmware repository site. A privileged attacker can potentially gather associated ismsnap maintenance data. The preconditions for vulnerability include the Download Firmware function being enabled and configured, and the use of the backslash character in a user credential of the remote proxy host or firmware repository server.

Recommendations For versions prior to 2.8.0.061, update to version 2.8.0.061 or later to resolve the issue. As a temporary workaround, consider restricting access to the ismsnap component and avoiding the use of the backslash character in user credentials for the remote proxy host or firmware repository server.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-39903

Affected Products

Fujitsu Software Infrastructure Manager

References · 5

• https://security.ts.fujitsu.com/IndexDownload.asp?SoftwareGuid=a0131919-6d84-43b4-800e-d7f78200a70f · Patch
• https://osv.dev/vulnerability/CVE-2023-39903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39903 · Security Note
• https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-ISS-IS-2023-071410-Security-Notice.pdf · Vendor Advisory
• https://t.me/cvenotify/55895 · Telegram Post