CVE-2023-38995: Critical Database Password Exposure in Schuhfried

CVE-2023-38995 is a Critical severity (CVSS 9.8) flaw in SCHUHFRIED 8.22.00 that lets an unauthenticated remote user obtain the backend database password. The researchers who published it report no fixed version and no workaround, so contact the vendor, restrict access to the service and rotate the credential.

What's affected

The record lists SCHUHFRIED version 8.22.00. The advisory, published by the POST Cyberforce team, says versions up to and including 8.22.00 are affected. The advisory describes Schuhfried as a multi-environment platform with a desktop client and a web service, which stores test reports.

The advisory states two things about remediation. Its summary lists the fixed product version as not available, and workarounds as none. Its recommendation is to contact the vendor to receive an updated version.

The advisory's timeline matters for planning. The researchers say they notified the vendor in May 2023, the vendor acknowledged the report, MITRE assigned the CVE in August 2023, and the advisory was released publicly on 1 February 2024 with no feedback from the vendor. We could not find a vendor advisory to confirm a fix, so the status may have changed since then and should be checked directly.

There is also a small naming difference. The record lists CWE-798 (hard-coded credentials), while the advisory lists CWE-259 (hard-coded password). Both describe a credential exposure.

How to check if you're exposed

If you run Schuhfried, confirm the installed version with your administrator or the vendor's documentation. Version 8.22.00 and earlier is in scope.

The weakness is that configuration files used by the client are served by the web service without a login, and they contain the credentials for the backend database. From inside your own network, ask your administrator to review which static content the web service serves and whether any configuration files are reachable without authentication. Do this through the vendor or your own application owner rather than by probing the service from outside.

Then review database logs. Look for logins to the backend database from addresses other than the application server, and for unexpected account changes.

What to do now

1. Confirm whether you run Schuhfried and which version. Treat 8.22.00 and earlier as affected.
2. Contact the vendor and ask for a fixed version or written mitigation. The advisory says none was available.
3. Restrict network access to the web service to the networks and users that need it, and keep it off the public internet where possible.
4. Rotate the backend database password once the exposure is closed, and limit that database account to the permissions the application needs.
5. Review database and web server logs for access from unexpected sources, and check for added or changed accounts.

Why it matters

The record maps this to CWE-798 (use of hard-coded credentials). The advisory describes the mechanism in terms of exposure: files that hold the database connection details are reachable by anyone, without authentication. Once someone holds a database password they no longer need the application at all. The advisory lists adding, deleting or updating accounts and data, privilege escalation and access to test reports as validated impacts.

That last item is what raises the stakes for this product. Test reports can hold personal data about the people who were tested, so involve your privacy team as well as your administrators. The record scores it 9.8 with no privileges and no user interaction. It is not marked as exploited in the record and it is not in the CISA Known Exploited Vulnerabilities catalog. With no fix or workaround on record, network restriction and credential rotation are the main controls available to you.

Quick check

Sources

• POST Cyberforce advisory for CVE-2023-38995 (PDF, February 2024)
• Record data for CVE-2023-38995

Last reviewed: 19 October 2026.