The Mesalvo Meona Client Launcher and Server components contain a critical privilege assignment vulnerability that exposes sensitive user credentials to unauthorized export.

This vulnerability involves an incorrect privilege assignment within the Meona SQL editor interface. It allows an authenticated user to perform unauthorized data exports, bypassing intended security controls to access cleartext passwords.

The potential for unauthorized access to cleartext passwords presents a severe risk to organizational security, potentially leading to widespread account compromise and unauthorized lateral movement. Given the CVSS score of 7.2, this vulnerability represents a high-severity threat that could result in significant data breaches and a loss of organizational integrity.

Immediate Action: Consult the official Mesalvo security advisory to identify and apply the necessary security updates or configuration changes.

Proactive Monitoring: Audit SQL editor access logs and monitor for anomalous data export activities or unauthorized database queries.

Compensating Controls: Restrict access to the SQL editor component to the minimum number of necessary administrative personnel until a patch is applied.

Public Exploit Available: false

Organizations utilizing Mesalvo Meona software must prioritize this issue due to the high risk of credential exposure. Administrators should verify their current version against the vendor's guidance and apply all available security updates immediately to mitigate the risk of data exfiltration.