CVE-2023-42955

MEDIUM

FileMaker Server 20.3.1 - Info Disclosure

Title source: llm

Description

Claris International has successfully resolved an issue of potentially exposing password information to front-end websites when signed in to the Admin Console with an administrator role. This issue has been fixed in FileMaker Server 20.3.1 by eliminating the send of Admin Role passwords in the Node.js socket.

References (1)

[Vendor Advisory] https://support.claris.com/s/article/Administrator-role-passwords-being-exposed-when-logged-into-the-Admin-Console?language=en_US

Scores

CVSS v3 4.9

EPSS 0.0019

EPSS Percentile 40.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-522 CWE-257

Status published

Affected Products (1)

claris/filemaker_server < 20.3.1

Timeline

Published May 14, 2024

Tracked Since Feb 18, 2026