Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.
Solution:
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
| Link | Tags |
|---|---|
| https://www.gov.il/en/departments/faq/cve_advisories | third party advisory |