Hard-coded secrets in plain text format found in Kiuwan Local Analyzer JAR files

CVE-2023-49113

What is CVE-2023-49113?

The Kiuwan Local Analyzer exposes sensitive information through hard-coded secrets within its Java scanning application. Several credentials were discovered in the JAR files, including usernames and passwords for GitHub accounts stored in plain text format. The presence of these hard-coded secrets not only undermines the confidentiality of scan results but also poses a significant security risk. Specifically, the file 'InsightServicesConfig.properties' in the 'optimyth-insight.jar' JAR file contains pre-filled configuration tokens, while 'Encryptor.properties' holds the encryption key for scan results, further aggravating the exposure of sensitive data.

References