Critical severity · published Jun 12, 2019
CVE-2019-3947
Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
Fuji Electric V-Server before 6.0.33.0 stores database credentials in project files as plaintext. An attacker that can gain access to the project file can recover the database credentials and gain access to the database server.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
V-server · Fujielectric
before 6.0.33.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3947
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3947
www.securityfocus.com
http://www.securityfocus.com/bid/108740
Exploit
https://www.tenable.com/security/research/tra-2019-27
More from V-server
9.8
CVE-2019-18240
In Fuji Electric V-Server 4.0.6 and prior, several heap-based buffer overflows have been identified, which may allow an attacker to remotely execute arbitrary code
7.8
CVE-2024-38658
There is an Out-of-bounds read vulnerability in V-Server (v4.0.19.0 and earlier) and V-Server Lite (v4.0.19.0 and earlier)
7.8
CVE-2023-47586
Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier
7.8
CVE-2023-47585
Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier
7.8
CVE-2023-47584
Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier