title: ARC Informatique PcVue
description: The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
problem types: CWE-312 Cleartext Storage of Sensitive Information
affected:
{
product: PcVue 12 OAuth web service configuration
vendor: ARC Informatique
versions:
lessThan: 12.0.27, status: affected, version: All, versionType: custom
}
{
product: PcVue 15 OAuth web service configuration
vendor: ARC Informatique
versions:
status: affected, version: All
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: PcVue 12: The fix is available in Maintenance release 12.0.27
After installing the fix, users should update the Web Deployment Console (WDC) and re-deploy the Web Server.
All users using the affected component should install a patched release of the WDC and re-deploy the Web Server. This will allow the WDC to update and protect the database connection string, including clearing any sensitive information stored in the web.config file.
workarounds: ARC Informatique has identified additional steps users can apply to reduce the risk:
Uninstall the Web Server
All users not using the affected component should uninstall the web server. The OAuth web service and its configuration are part of the Web Server for PcVue. If the system does not require Web & Mobile features, then users should not install them.
Users should contact ARC Informatique’s PcVue Solutions for assistance with the above steps.
For additional information, visit the public ARC Informatique security alert page.