Vulnerability · Published Jan 25, 2022 · Assigned by INCD
CVE-2022-22789Charactell - FormStorm Enterprise Account Take Over
Medium 6.1
In plain English
A medium-severity security flaw in FormStorm Enterprise from Charactell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 95.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Charactell | FormStorm Enterprise | FormStorm Enterprise version 9.00.065 9.00.065 |
References
- https://www.gov.il/en/departments/faq/cve_advisories x_refsource_MISC