CVE-2023-3395CWE-256

​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory

Medium · published July 3, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with document, such as password. The attacker could then obtain the plaintext password by using a memory viewer.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2023-07-03T20:04Z
EPSS history
Timeline
  • 03 JUL 20:04Z
    ​All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory
    cvelistv5