CVE-2023-37468: medium-severity vulnerability in thm-mni-ii feedbacksystem
Storing unencrypted LDAP passwords in feedbacksystem
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6epss 0.2%
Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
thm-mni-ii · feedbacksystemRelated CVEs — thm-mni-ii feedbacksystem
In the same product, most dangerous first.