CVE-2023-37468
Storing unencrypted LDAP passwords in feedbacksystem
- State
- Published
- Severity
- 6.0 Medium
- Published
- Jul 13, 2023
- Updated
- Oct 22, 2024
- Reserved
- Jul 6, 2023
Description
Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.0 Medium | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N | GitHub_M |
Weaknesses
- CWE-312 Cleartext Storage of Sensitive Information
Affected Products
| Product | Versions |
|---|---|
feedbacksystemthm-mni-ii |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.