CVE-2023-28441CWE-532

smartCARS 3 Password Stored as plain text in Error Log

High · published March 23, 2023

CVSS v3.1
8.0
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-03-23T23:02Z
EPSS history
Timeline
  • 23 MAR 23:02Z
    smartCARS 3 Password Stored as plain text in Error Log
    cvelistv5