CVE-2023-39379

Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected products and versions are as follows: Fujitsu Software Infrastructure Manager Advanced Edition V2.8.0.060, Fujitsu Software Infrastructure Manager Advanced Edition for PRIMEFLEX V2.8.0.060, and Fujitsu Software Infrastructure Manager Essential Edition V2.8.0.060.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://jvn.jp/en/jp/JVN38847224/	Third Party Advisory
https://support.ts.fujitsu.com/IndexProdSecurity.asp?lng=en	Product

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060::::advanced:-::*
	cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060::::advanced:primeflex::*
	cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060::::essential:::

History

09 Aug 2023, 12:25

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
References	~~(MISC) https://jvn.jp/en/jp/JVN38847224/ -~~	(MISC) https://jvn.jp/en/jp/JVN38847224/ - Third Party Advisory
References	~~(MISC) https://support.ts.fujitsu.com/IndexProdSecurity.asp?lng=en -~~	(MISC) https://support.ts.fujitsu.com/IndexProdSecurity.asp?lng=en - Product
First Time		Fujitsu software Infrastructure Manager Fujitsu
CWE		CWE-312
CPE		cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060::::advanced:-::* cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060::::essential::: cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060::::advanced:primeflex::*

04 Aug 2023, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-08-04 10:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-39379

Mitre link : CVE-2023-39379

CVE.ORG link : CVE-2023-39379

JSON object : View

Products Affected

fujitsu

software_infrastructure_manager

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2023-39379", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-08-04T10:15:09.870", "references": [{"url": "https://jvn.jp/en/jp/JVN38847224/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://support.ts.fujitsu.com/IndexProdSecurity.asp?lng=en", "tags": ["Product"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form. As a result, the password for the proxy server that is configured in ISM may be retrieved. Affected products and versions are as follows: Fujitsu Software Infrastructure Manager Advanced Edition V2.8.0.060, Fujitsu Software Infrastructure Manager Advanced Edition for PRIMEFLEX V2.8.0.060, and Fujitsu Software Infrastructure Manager Essential Edition V2.8.0.060.\r\n"}, {"lang": "es", "value": "Fujitsu Software Infrastructure Manager (ISM) almacena informaci\u00f3n sensible en los datos de mantenimiento del producto (ismsnap) en forma de texto claro. Como resultado, la contrase\u00f1a para el servidor proxy que est\u00e1 configurado en ISM puede ser recuperada. Los productos y versiones afectados son los siguientes: Fujitsu Software Infrastructure Manager Advanced Edition V2.8.0.060, Fujitsu Software Infrastructure Manager Advanced Edition for PRIMEFLEX V2.8.0.060 y Fujitsu Software Infrastructure Manager Essential Edition V2.8.0.060."}], "lastModified": "2023-08-09T12:25:04.040", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060:*:*:*:advanced:-:*:*", "vulnerable": true, "matchCriteriaId": "EAED8D54-C6FD-45B0-93BB-C2CA9AD9161F"}, {"criteria": "cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060:*:*:*:advanced:primeflex:*:*", "vulnerable": true, "matchCriteriaId": "46473D49-C265-48D1-B903-DBE760EB16AA"}, {"criteria": "cpe:2.3:a:fujitsu:software_infrastructure_manager:2.8.0.060:*:*:*:essential:*:*:*", "vulnerable": true, "matchCriteriaId": "7F48F74F-D51E-4DFA-8636-E239E6A425C9"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}