Vulnerability · Published Jul 13, 2023 · Assigned by GitHub_M

CVE-2023-37468Storing unencrypted LDAP passwords in feedbacksystem

Medium 6.0

In plain English

A medium-severity security flaw in feedbacksystem from thm-mni-ii. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.

Affected products (as reported)

Vendor	Product	Versions
thm-mni-ii	feedbacksystem	>= 1.5.0, < 1.19.2

Weakness: CWE-312 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349 x_refsource_CONFIRM
https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c7704426325bcf x_refsource_MISC
https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2 x_refsource_MISC