Brain2
Monthly
BRAIN2 installations up to and including version 3.09 can write the cleartext password of the Windows service account that runs the BRAIN2 MainService into a setup log file, but only when Microsoft SQL Server access is configured with Integrated Security and the service account is specified during the installation wizard. The log lands in the temporary directory of the administrator who ran the installer, which the vendor states is normally restricted to administrative users, so an attacker needs local access and effective administrative rights to reach the credential. CVSS 3.1 scores this 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
BRAIN2 installations up to and including version 3.09 can write the cleartext password of the Windows service account that runs the BRAIN2 MainService into a setup log file, but only when Microsoft SQL Server access is configured with Integrated Security and the service account is specified during the installation wizard. The log lands in the temporary directory of the administrator who ran the installer, which the vendor states is normally restricted to administrative users, so an attacker needs local access and effective administrative rights to reach the credential. CVSS 3.1 scores this 4.4 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N); no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.