Junglewise Threat Intelligence

CVE-2024-6833: Zowe CLI plaintext credential storage in auto-init

CVE-2024-6833 · Severity: low · CVSS 3.1 · Published 2024-07-17

Vendors: npm.

Executive brief

Zowe CLI is a command-line interface for mainframe systems. A vulnerability allows local, privileged users to accidentally store secure credentials in plaintext files during automatic initialization, potentially exposing sensitive data to unauthorized access if system files are compromised.

Technical details

The vulnerability (CWE-256: Plaintext Storage of Password) exists in Zowe CLI versions 7.18.0 through 7.23.4, where the auto-init operation stores previously entered secure credentials in plaintext rather than encrypted form. This requires local access and elevated privileges, plus user interaction (e.g., confirmation of initialization). An attacker with local file system access to the affected system could read these plaintext credentials. The issue was fixed in version 7.23.5 (commit 6778da5e).

Affected products

  • Zowe CLI 7.18.0 to 7.23.4

Timeline

  • 2024-07-17: disclosed: Published as GHSA-ghgq-x6wc-6jr5 and CVE-2024-6833
  • 2024-07-17: patched: Fixed in version 7.23.5

References