{"id":24236,"date":"2025-06-27T16:07:37","date_gmt":"2025-06-27T14:07:37","guid":{"rendered":"https:\/\/herolab.usd.de\/security-advisories\/usd-2025-0023\/"},"modified":"2025-07-01T10:20:36","modified_gmt":"2025-07-01T08:20:36","slug":"usd-2025-0023","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2025-0023\/","title":{"rendered":"usd-2025-0023"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.21.0\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\" global_colors_info=\"{}\"][et_pb_row _builder_version=\"4.25.2\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_column type=\"4_4\" _builder_version=\"4.21.0\" _module_preset=\"default\" global_colors_info=\"{}\"][et_pb_text _builder_version=\"4.27.4\" _module_preset=\"default\" custom_padding=\"||13px|||\" global_colors_info=\"{}\"]<\/p>\n

usd-2025-0023 | Agorum core open 11.9.1.3-1857 - Plaintext Storage of a Password<\/h1>\n

<\/h1>\n

Product<\/strong>: Agorum core open
Affected Version<\/strong>: 11.9.1.3-1857
Vulnerability Type<\/strong>: Plaintext Storage of a Password (CWE-256)
Security Risk<\/strong>: High
Vendor<\/strong>: Agorum
Vendor URL<\/strong>: https:\/\/www.agorum.com\/<\/a>
Vendor acknowledged vulnerability<\/strong>: Yes
Vendor Status<\/strong>: Fixed
CVE Number<\/strong>: Requested
CVE Link<\/strong>: Requested
Advisory ID<\/strong>: usd-2025-0023<\/p>\n

Description<\/h3>\n

agorum core is an open-source Enterprise Content Management (ECM) system developed by agorum Software GmbH in Germany. It offers a modular, highly customizable platform for document management, workflow automation, and digital collaboration.<\/p>\n

Proof of Concept<\/h3>\n

During the installation process, the system administrator must define passwords for the mainadmin<\/em>, demo<\/em>, and database<\/em> users. Upon successful installation, a datasheet will be created in the agorumcore\/doc<\/strong> directory. The agorum-core-datasheet.txt<\/strong> contains the previously defined passwords in plaintext:<\/p>\n

\n
<\/span>Datasheet agorum core:
Directories and Scripts:
  Installdirectory:
                \/opt\/agorum\/agorumcore
  Backupdirectory:
                 \/opt\/agorum\/agorumcore\/backup
  Start-\/Stop- agorum core:
        \/opt\/agorum\/agorumcore\/scripts\/agorumcore start\/stop
  Backup-Script:
        \/opt\/agorum\/agorumcore\/scripts\/agorumcorebackupAccess\/Protocols:
  Web-Portal (secure):
        [https:\/\/172.17.0.1:443]()
  Web-Portal (unsecure):
        [http:\/\/172.17.0.1:81]()
  Networkdrive (DMS Filearea):
     \\\\\\\\172.17.0.1\\\\dms
  Networkdrive (My area):
      \\\\\\\\172.17.0.1\\\\private
  FTP Access:
                  172.17.0.1:21
  IMAP-Interface:
                  172.17.0.1:143
  SMTP-Interface:
                  172.17.0.1:2501
  Mail-Domain:
                     agorumcore.com
  SMTP-Server:
                     localhost:25
  SMTP-User:
  SMTP-Password:
Access data agorum core:
  Username (Mainadmin):
      roi  Password (Mainadmin: roi):
      Changeme123456
  Username (Demo):
      demo  Password  (Demo):
      demoAccess database (mysql):
  database-Username: root  
  database-Password: Changeme123456
  database-Host: localhost
  database-Port: 3306
  Miscellaneous Ports:
  agorum core SessionUnlock Port:  17676
  JBoss RMI Port:                  31098
  JBoss JNP Port:                  31099
  JBoss RMI-Object Port:           34444
  JBoss Pooled-Invoker Port:       34445
  JBoss WebService Port:           38083
  JBoss UIL2 Port:                 38093
  OpenOffice Port:                 8100<\/pre>\n<\/div>\n
Storing passwords in plaintext poses a significant security risk, particularly when combined with other vulnerabilities. This practice exposes sensitive user credentials to unauthorized access and can lead to a range of severe consequences, especially when attackers can easily exploit other vulnerabilities without needing authentication.<\/p>\n
Fix<\/h3>\n

It is recommended that passwords be securely hashed using strong cryptographic algorithms to ensure they are never stored in plaintext.<\/p>\n
 <\/p>\n
Users of agorum core open should upgrade to versions 11.9.2 or 11.10.1.<\/p>\n
References<\/h3>\n
<\/p>\n