CVEvulnerability

CVE-2023-42955

4.9 MEDIUM Published 2024-05-14 Modified 2026-06-17 Official page ↗

Status: Analyzed
Published: 2024-05-14
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 4.9 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 6.1 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L
Weaknesses: CWE-257, CWE-522

Description

Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by eliminating the send of Admin Role passwords in the Node.js socket.

Affected configurations

• claris filemaker server (< 20.3.1)

Weakness · CWE (2)

CWE-257 Storing Passwords in a Recoverable Format weakness
CWE-522 Insufficiently Protected Credentials weakness

References

https://support.claris.com/s/article/Administrator-role-passwords-being-exposed-when-logged-into-the-Admin-Console?language=en_US Vendor Advisory
https://support.claris.com/s/article/Administrator-role-passwords-being-exposed-when-logged-into-the-Admin-Console?language=en_US Vendor Advisory

CVE-2023-42955

Description

Affected configurations

Related

Weakness · CWE (2)

References