CVE-2022-33928: dell wyse_management_suite Plaintext Storage of a Password

Vulnerability summary

CVE-2022-33928 is a high (CVSS 8.8) Plaintext Storage of a Password vulnerability in dell wyse_management_suite. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.7% of scored vulnerabilities.

Timeline

1. 10-08-2022
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.

• CWE-256Plaintext Storage of a PasswordThe product stores a password in plaintext within resources such as memory or files.
• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.