Cleartext Storage of Sensitive Information

CVE-2024-55582

Medium

5.7/10

Summary

Oxide before 6 has unencrypted Control Plane datastores.

Attack Complexity: HIGH
Attack Vector: PHYSICAL
Integrity Impact: HIGH
Scope: UNCHANGED
User Interaction: NONE
Privileges Required: NONE
Confidentiality Impact: HIGH
Availability Impact: NONE

CWE-312 - Cleartext Storage of Sensitive Information

The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References

Advisory Timeline

Published Dec 09, 2024