CVE-2022-38469 - An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords

Back Back to CVE browser

HIGH

An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords

Published Jan 17, 2023

7.5

HIGH

CVSS 3.1

EPSS 0.61%

Description

An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.

Affected products

Vendor GE Digital Product Proficy Historian Default
unaffected
- Version
  7.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GE Digital

Proficy Historian

unaffected

Version	Status	Constraints
7.0	affected	-

Remediation

Vendor solution

GE Digital released Proficy Historian 2023 https://www.ge.com/digital/applications/proficy-historian to mitigate these vulnerabilities. SIMs have also been released for all affected versions.Users can find out more about the vulnerabilities, how to obtain, and install the updates by visiting this notification document from GE Digital https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01 .

Weaknesses (2)

CWE-261

CWE-522

Insufficiently Protected Credentials

References (3)

https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
Permissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41052
Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01
Third Party AdvisoryUS Government Resource

Link	Providers	Tags
https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01		Permissions RequiredVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-41052		Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01		Third Party AdvisoryUS Government Resource