CVE-2023-50894: 
Janitza GridVis vulnerability analysis and mitigation

CVE-2023-50894 affects Janitza GridVis through version 9.0.66. The vulnerability involves the use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function. This vulnerability was discovered and reported by Fabian Weber (Code White).

The vulnerability exists in the password encryption function of Janitza GridVis, specifically in the de.janitza.pasw.feature.impl.activators.PasswordEncryption component. The issue stems from the use of hard-coded credentials in the encryption process. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 HIGH with the vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

When exploited, this vulnerability allows remote authenticated administrative users to discover cleartext database credentials contained in error report information. This exposure of sensitive credentials could potentially lead to unauthorized database access (NVD).

The vulnerability requires authenticated administrative access to exploit. Once authenticated, an attacker can leverage the hard-coded credentials in the password encryption function to expose cleartext database credentials through error report information (NVD).

The vulnerability has been fixed in version 9.0.67 of Janitza GridVis. Users are advised to upgrade to this version or later to address the security issue (Code White).