Asseco InfoMedica Plus Password Decoding Vulnerability

A vulnerability exists in Asseco InfoMedica Plus versions 4.0.0 prior to 4.50.1 and 5.0.0 prior to 5.38.0, allowing encoded passwords stored in the database to be decoded using a client-side algorithm. This issue arises from passwords being stored in a recoverable format, combined with a lack of proper access control, enabling low-privileged users to access the encoded passwords of other accounts, including the main administrator. Exploiting this vulnerability could lead to unauthorized privilege escalation.

Impact

Exploitation of this vulnerability allows for the decoding of encoded passwords, which could then be used to gain unauthorized access to user accounts, including administrative privileges.

Remediation

Users can upgrade to Asseco InfoMedica Plus versions 4.50.1 or 5.38.0 to address this vulnerability.