A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in the device properties. (Viewing the passwords requires configuring a web browser to display HTML password input fields.)
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lpar2rrd | Xorux | 7.21 (including) | 7.30 (excluding) |
| Stor2rrd | Xorux | 7.21 (including) | 7.30 (excluding) |
Potential Mitigations
Related Attack Patterns
References
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-f3qp-4xqq-2wjx
- https://lpar2rrd.com/note730.php
- https://stor2rrd.com/note730.php
- https://github.com/orangecertcc/security-research/security/advisories/GHSA-f3qp-4xqq-2wjx
- https://lpar2rrd.com/note730.php
- https://stor2rrd.com/note730.php