CVE-2023-39903
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Fujitsu Software Infrastructure Manager (ISM) before version 2.8.0.061, authorization credentials are insecurely collected and stored in cleartext in the file /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log. This occurs when users test the connection to a firmware repository or regularly authenticate against a configured remote firmware repository, if a backslash character is used in the user credentials (ID or password).
Risk Assessment
A privileged attacker can collect ismsnap maintenance data, including cleartext credentials, enabling unauthorized access to remote firmware repositories and potential further attack escalation.
Recommendation
Immediately update Fujitsu Software Infrastructure Manager to version 2.8.0.061 or later. Until the update is applied, disable the Download Firmware (Firmware Repository Server) function and avoid using backslash characters in user credentials.
Original NVD description (English source)
An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379.