Lucene search

INCDCVELIST:CVE-2022-22789

HistoryJan 25, 2022 - 7:11 p.m.

CVE-2022-22789 Charactell - FormStorm Enterprise Account Take Over

2022-01-2519:11:08

INCD

www.cve.org

charactell

formstorm

account takeover

cve-2022-22789

usernames

cleartext

obfuscated password

file modification

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

EPSS

Percentile

12.6%

JSON

Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.

CNA Affected

[
  {
    "product": "FormStorm Enterprise",
    "vendor": "Charactell ",
    "versions": [
      {
        "status": "affected",
        "version": "FormStorm Enterprise version 9.00.065 9.00.065"
      }
    ]
  }
]

References

www.gov.il/en/departments/faq/cve_advisories