CVE-2022-43958: siemens qms_automotive Plaintext Storage of a Password

Vulnerability summary

CVE-2022-43958 is a high (CVSS 7.6) Plaintext Storage of a Password vulnerability in siemens qms_automotive. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.1% of scored vulnerabilities.

Timeline

1. 08-11-2022
   PublishedVulnerability first disclosed.
2. 21-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext in the database without any hashing mechanism. This could allow an attacker to gain access to credentials and impersonate other users.

• CWE-256Plaintext Storage of a PasswordThe product stores a password in plaintext within resources such as memory or files.
• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.