Insecure Credential Storage in Fujitsu Software Infrastructure Manager
CVE-2023-39903
What is CVE-2023-39903?
A vulnerability has been identified in Fujitsu Software Infrastructure Manager (ISM) versions prior to 2.8.0.061. This issue arises from the ismsnap component's inadequate handling of authorization credentials, which are stored in cleartext within the FirmwareManagement.log file. This occurs specifically during the setup testing of the ISM Firmware Repository Address or while authenticating with a configured remote firmware repository. An authorized attacker could exploit this vulnerability to collect sensitive maintenance data by leveraging the same privileges as trusted users. The vulnerability is particularly exploitable when both the Download Firmware function is enabled and the backslash character is present in user credentials for remote proxy host or firmware repository server configurations. Organizations using affected versions should review their configurations and apply the latest updates to mitigate risks.