What’s Vulnerable › Vulnerabilities
CVE-2022-47561: Unprotected Storage of Credentials in Ormazabal products
- Severity: medium (CVSS 5.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-09-20 · updated 2026-06-17
- Weakness: CWE-256
Description
The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.
Affected products
References
- https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
- https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-ormazabal-products
Get alerted when CVE-2022-47561 or the next vulnerability affects your stack