The Kiuwan Local Analyzer (KLA) Java scanning application contains several
hard-coded secrets in plain text format. In some cases, this can
potentially compromise the confidentiality of the scan results.Β Several credentials were found in the JAR files of the Kiuwan Local Analyzer.
The
JAR file βlib.engine/insight/optimyth-insight.jarβ contains the file
βInsightServicesConfig.propertiesβ, which has the configuration tokens
βinsight.github.userβ as well as βinsight.github.passwordβ prefilled
with credentials. At least the specified username corresponds to a valid
GitHub account.Β The
JAR file βlib.engine/insight/optimyth-insight.jarβ also contains the
file βes/als/security/Encryptor.propertiesβ, in which the key used for
encrypting the results of any performed scan.
This issue affects Kiuwan SAST: <master.1808.p685.q13371
[
{
"defaultStatus": "affected",
"product": "SAST Local Analyzer",
"vendor": "Kiuwan",
"versions": [
{
"status": "affected",
"version": "<master.1808.p685.q13371",
"versionType": "custom"
}
]
}
]