Lucene search

BDCVELIST:CVE-2023-29064

HistoryNov 28, 2023 - 8:35 p.m.

CVE-2023-29064 Hardcoded Secrets

2023-11-2820:35:30

CWE-798

www.cve.org

cve-2023-29064

sensitive information

plaintext

threat actor

tokens

passwords

administrative accounts

CVSS3

4.1

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

Confidence

High

EPSS

Percentile

12.7%

JSON

The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include tokens and passwords for administrative accounts.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "64 bit"
    ],
    "product": "FACSChorus",
    "vendor": "Becton, Dickinson and Company (BD)",
    "versions": [
      {
        "lessThanOrEqual": "5.1",
        "status": "affected",
        "version": "5.0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-facschorus-software