Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

Kiuwan Local Analyzer (KLA) Java scanning application

Source

551230f0-3615-47bd-b7cc-93e92e730bbf

CVE-2023-49113 details

Published : June 20, 2024, 1:15 p.m.
Last Modified : June 20, 2024, 4:07 p.m.

Description

The Kiuwan Local Analyzer (KLA) Java scanning application contains several hard-coded secrets in plain text format. In some cases, this can potentially compromise the confidentiality of the scan results. Several credentials were found in the JAR files of the Kiuwan Local Analyzer. The JAR file "lib.engine/insight/optimyth-insight.jar" contains the file "InsightServicesConfig.properties", which has the configuration tokens "insight.github.user" as well as "insight.github.password" prefilled with credentials. At least the specified username corresponds to a valid GitHub account. The JAR file "lib.engine/insight/optimyth-insight.jar" also contains the file "es/als/security/Encryptor.properties", in which the key used for encrypting the results of any performed scan. This issue affects Kiuwan SAST: <master.1808.p685.q13371

CVSS Score

1	2	3	4	5	6	7	8	9	10

Weakness

Weakness	Name	Description
CWE-312	Cleartext Storage of Sensitive Information	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References

URL	Source
https://r.sec-consult.com/kiuwan	551230f0-3615-47bd-b7cc-93e92e730bbf
https://www.kiuwan.com/docs/display/K5/%5B2024-05-30%5D+Change+Log	551230f0-3615-47bd-b7cc-93e92e730bbf

This website uses the NVD API, but is not approved or certified by it.

CVE-2023-49113