title: Charactell - FormStorm Enterprise Account Take Over
description: Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can take over an account by replacing existing password in the file.
problem types: Account Take Over
affected:
{
product: FormStorm Enterprise
vendor: Charactell
versions:
status: affected, version: FormStorm Enterprise version 9.00.065 9.00.065
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L
version: 3.1
]
solutions: A patch was released, Charactell - FormStorm Enterprise version 9.00.066