CVE-2012-0059CWE-209

Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages

Medium · published February 5, 2014

CVSS v3.1
4.9
EPSS
2%
Percentile
76.0
In the wild
Unconfirmed
What it is

A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01635 · 76.0th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2014-02-05T18:00Z
EPSS history
Timeline
  • 05 FEB 18:00Z
    Spacewalk-backend: spacewalk-backend: information disclosure via cleartext passwords in error messages
    cvelistv5