CVE-2023-31041

Published: Aug 14, 2023Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. System password information could optionally be stored in cleartext, which might lead to possible information disclosure.

Affected (6)

Products: Insyde: Insydeh2o

Insyde

1 product

Insydeh2o

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Insyde Insydeh2o	Version 5.0
Insyde Insydeh2o	Version 5.1
Insyde Insydeh2o	Version 5.2
Insyde Insydeh2o	Version 5.3
Insyde Insydeh2o	Version 5.4
Insyde Insydeh2o	Version 5.5

Related CWEs

CWE-312

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (2)

https://www.insyde.com/security-pledge/SA-2023047

Source: cve@mitre.org

Vendor Advisory

https://www.insyde.com/security-pledge/SA-2023047

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.