OpenConcerto performs plaintext storage of user passwords, a weakness classified as CWE‑256. An attacker who obtains access to the application’s storage files can directly read these credentials and any other embedded sensitive data, potentially leading to user account compromise and lateral movement within the system. The description indicates that the vulnerability allows the retrieval of embedded sensitive data, meaning that confidentiality and integrity of stored credentials are lost.

Vendors: ILM Informatique. Product: OpenConcerto. Version affected: 1.7.5.

The CVSS score of 4.8 indicates a medium severity with limited impact from the data provided. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited exploitation activity reported to date. The attack vector is not explicitly described; it is inferred to require access to the system’s configuration or data storage files, which could be achieved locally or remotely if the application is exposed to network interfaces. The weakness allows direct retrieval of plaintext passwords, providing an attacker with user credentials and potentially other sensitive information stored within the same files.