CVE-2021-39342CWE-319

Credova_Financial <= 1.4.8 Sensitive Information Disclosure

Medium · published September 29, 2021

CVSS v3.1
5.3
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions up to, and including, 1.4.8.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00767 · 55.0th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2021-09-29T19:39Z
EPSS history
Timeline
  • 29 SEP 19:39Z
    Credova_Financial <= 1.4.8 Sensitive Information Disclosure
    cvelistv5