CVE-2024-22432CWE-256

Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups

High · published January 25, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
2.7
In the wild
Unconfirmed
What it is

Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups. User has low privilege access to Networker Client system could potentially exploit this vulnerability, leading to the disclosure of configured MySQL Database user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application Database with privileges of the compromised account.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00136 · 2.7th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2024-01-25T14:53Z
EPSS history
Timeline
  • 25 JAN 14:53Z
    Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL Database backups
    cvelistv5