CVE-2024-31840

Name of the Vulnerable Software and Affected Versions Italtel Embrace version 1.6.4

Description An issue was discovered where the web application inserts cleartext passwords in the HTML source code. An authenticated user can edit the configuration of the email server. When accessing the edit function, the web application fills the edit form with the current credentials for the email account, including the cleartext password.

Recommendations For Italtel Embrace version 1.6.4, consider restricting access to the edit function for the email server configuration to minimize the risk of exploitation. As a temporary workaround, avoid using the edit function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.