Executive brief
Zowe CLI is a command-line interface for mainframe systems. A vulnerability allows local, privileged users to accidentally store secure credentials in plaintext files during automatic initialization, potentially exposing sensitive data to unauthorized access if system files are compromised.
Technical details
The vulnerability (CWE-256: Plaintext Storage of Password) exists in Zowe CLI versions 7.18.0 through 7.23.4, where the auto-init operation stores previously entered secure credentials in plaintext rather than encrypted form. This requires local access and elevated privileges, plus user interaction (e.g., confirmation of initialization). An attacker with local file system access to the affected system could read these plaintext credentials. The issue was fixed in version 7.23.5 (commit 6778da5e).
Affected products
- Zowe CLI 7.18.0 to 7.23.4
Timeline
- 2024-07-17: disclosed: Published as GHSA-ghgq-x6wc-6jr5 and CVE-2024-6833
- 2024-07-17: patched: Fixed in version 7.23.5