FUXA Information Disclosure Vulnerability Allowing Access to InfluxDB Credentials

A critical information disclosure vulnerability exists in FUXA, a web-based process visualization software, through version 1.2.9. This vulnerability allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials, including those for InfluxDB. Exploitation of this vulnerability enables access to the full system configuration and could lead to unauthorized reading, modification, or deletion of historical process data. Additionally, the InfluxDB database could be corrupted, causing a denial-of-service condition.

Impact

Exploitation of this vulnerability allows for unauthorized access to InfluxDB administrative credentials, enabling an attacker to authenticate to the database, manipulate or delete process data, or disrupt database operations, causing a denial-of-service condition.

Remediation

Users are advised to update to FUXA version 1.2.10, where this vulnerability has been patched.