description:
An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords.
problem types: CWE-261 Weak Encoding for Password
affected:
{
defaultStatus: unaffected
product: Proficy Historian
vendor: GE Digital
versions:
status: affected, version: 7.0
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: GE Digital released  Proficy Historian 2023 https://www.ge.com/digital/applications/proficy-historian  to mitigate these vulnerabilities.  SIMs have also been released for all affected versions.Users can find out more about the vulnerabilities, how to obtain, and install the updates by visiting  this notification document from GE Digital https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01 .