CVE-2023-0815CWE-532

Plaintext Password Present in the Web logs

Medium · published February 23, 2023

CVSS v3.1
6.8
EPSS
1%
Percentile
49.7
In the wild
Unconfirmed
What it is

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users

should upgrade to Meridian 2023.1.0 or newer, or Horizon 31.0.4. Meridian and

Horizon installation instructions state that they are intended for installation

within an organization's private networks and should not be directly accessible

from the Internet.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00633 · 49.7th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-02-23T14:52Z
EPSS history
Timeline
  • 23 FEB 14:52Z
    Plaintext Password Present in the Web logs
    cvelistv5