CVE-2023-37468CWE-312

Storing unencrypted LDAP passwords in feedbacksystem

Medium · published July 13, 2023

CVSS v3.1
6.0
EPSS
0%
Percentile
6.2
In the wild
Unconfirmed
What it is

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.

The record
Technical detail
CVSS v3.1
6.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00171 · 6.2th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2023-07-13T20:18Z
EPSS history
Timeline
  • 13 JUL 20:18Z
    Storing unencrypted LDAP passwords in feedbacksystem
    cvelistv5