CVE-2023-39903

An issue was discovered in Fujitsu Software Infrastructure Manager (ISM) before 2.8.0.061. The ismsnap component (in this specific case at /var/log/fujitsu/ServerViewSuite/ism/FirmwareManagement/FirmwareManagement.log) allows insecure collection and storage of authorization credentials in cleartext. That occurs when users perform any ISM Firmware Repository Address setup test (Test the Connection), or regularly authorize against an already configured remote firmware repository site, as set up in ISM Firmware Repository Address. A privileged attacker is therefore able to potentially gather the associated ismsnap maintenance data, in the same manner as a trusted party allowed to export ismsnap data from ISM. The preconditions for an ISM installation to be generally vulnerable are that the Download Firmware (Firmware Repository Server) function is enabled and configured, and that the character \ (backslash) is used in a user credential (i.e., user/ID or password) of the remote proxy host / firmware repository server. NOTE: this may overlap CVE-2023-39379.

• CWE-312

• https://security.ts.fujitsu.com/IndexDownload.asp?SoftwareGuid=a0131919-6d84-43b4-800e-d7f78200a70fPatch
• https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-ISS-IS-2023-071410-Security-Notice.pdfPatch, Vendor Advisory
• https://security.ts.fujitsu.com/IndexDownload.asp?SoftwareGuid=a0131919-6d84-43b4-800e-d7f78200a70fPatch
• https://security.ts.fujitsu.com/ProductSecurity/content/Fujitsu-PSIRT-ISS-IS-2023-071410-Security-Notice.pdfPatch, Vendor Advisory

Published

Aug 7, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3986A vulnerability was found in SourceCodester Simple Online Me…4.8
• CVE-2023-3987A vulnerability was found in SourceCodester Simple Online Me…9.8
• CVE-2023-3988A vulnerability was found in Cafe Billing System 1.0. It has…9.8
• CVE-2023-3989A vulnerability was found in SourceCodester Jewelry Store Sy…6.1
• CVE-2023-3990A vulnerability classified as problematic has been found in …6.1
• CVE-2023-39902A software vulnerability has been identified in the U-Boot S…7.8
• CVE-2023-39908The PKCS11 module of the YubiHSM 2 SDK through 2023.01 does …7.5
• CVE-2023-39909Ericsson Network Manager before 23.2 mishandles Access Contr…8.8
• CVE-2023-3991An OS command injection vulnerability exists in the httpd ip…9.8
• CVE-2023-39910The cryptocurrency wallet entropy seeding mechanism used in …7.5
• CVE-2023-39912Zoho ManageEngine ADManager Plus before 7203 allows Help Des…4.9
• CVE-2023-39913Deserialization of Untrusted Data, Improper Input Validation…8.8