Insecure Credential Storage in TSplus Remote Access Product
CVE-2023-31069

9.8CRITICAL

Key Information:

Vendor

Tsplus

Status
Tsplus Remote Access
Vendor
CVE Published:
11 September 2023

What is CVE-2023-31069?

A vulnerability has been identified in TSplus Remote Access, specifically in versions up to 16.0.2.14. This issue arises from the insecure storage of user credentials, being kept in cleartext within the HTML source code of the login page. Such exposure could allow malicious actors to easily access sensitive information, facilitating unauthorized access and data breaches. Users are advised to review their security measures and update to a secured version to mitigate the risk associated with this vulnerability.

References

http://packetstormsecurity.com/files/174271/TSPlus-16.0.0...
https://www.exploit-db.com/exploits/51681

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.