Sh3
Monthly
Stored user credentials in SH3, within the Módulo de Gestão and Módulo de Arrecadação components, are protected only by a reversible XOR-based encoding rather than a computationally expensive one-way password hash (CWE-916), so anyone able to read that credential data can reverse it back to plaintext. Only authenticated, high-privileged users (CVSS PR:H) can reach the affected data, and the vendor rates exploitability as difficult with high attack complexity; impact is limited to confidentiality of stored credentials with no integrity or availability effect, giving a low severity score (CVSS 4.0 base 2.1, independently assessed as CVSS 3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). A public PoC reference exists in the form of a Medium write-up; it is not verified as working exploit code, and there is no KEV listing or other indication of active exploitation. Priority is monitor.
Stored user credentials in SH3, within the Módulo de Gestão and Módulo de Arrecadação components, are protected only by a reversible XOR-based encoding rather than a computationally expensive one-way password hash (CWE-916), so anyone able to read that credential data can reverse it back to plaintext. Only authenticated, high-privileged users (CVSS PR:H) can reach the affected data, and the vendor rates exploitability as difficult with high attack complexity; impact is limited to confidentiality of stored credentials with no integrity or availability effect, giving a low severity score (CVSS 4.0 base 2.1, independently assessed as CVSS 3.1 AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N). A public PoC reference exists in the form of a Medium write-up; it is not verified as working exploit code, and there is no KEV listing or other indication of active exploitation. Priority is monitor.