CVE-2019-3947 Hardcoded credentials in Fuji Electric V-Server
Attackers with file access can recover plaintext database credentials from project files, leading to unauthorized database access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3947?
CVE-2019-3947 is a critical vulnerability in Fuji Electric V-Server, published on 12 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server.
Weakness: CWE-522
Which versions are affected by CVE-2019-3947?
It affects 1 product.
Products include Fujielectric V-Server.
How do I fix CVE-2019-3947?
No fix has been published for CVE-2019-3947 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3947 being exploited?
There is no known exploitation of CVE-2019-3947 in the wild and no public exploit code.
Other vulnerabilities in Fuji Electric V-Server
Sources
Also known as GHSA-grf6-v344-mj9v.