CVE-2022-4308 Clear-text passwords in configuration files
Attackers can abuse authentication on SiteManager if configuration files containing plaintext passwords are leaked.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-4308?
CVE-2022-4308 is a medium-severity vulnerability in Secomea GateManager, published on 19 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
Which versions are affected by CVE-2022-4308?
It affects 1 product.
Products include Secomea Gatemanager.
How do I fix CVE-2022-4308?
No fix has been published for CVE-2022-4308 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-4308 being exploited?
There is no known exploitation of CVE-2022-4308 in the wild and no public exploit code.
Other vulnerabilities in Secomea GateManager
- CVE-2021-32008 Logged-in Administrator may get unrestricted file system access
- CVE-2022-38123 Insufficient validation of plugin files
- CVE-2022-2752 Potential vulnerabilities in GM login process
- CVE-2021-32009 Missing XSS guards on firmware page
- CVE-2021-32006 GateManager information leak for LinkManager Users
Sources
Also known as GHSA-xr26-qphw-jcg8.