7.5
CVE-2020-17495
- EPSS 0.86%
- Veröffentlicht 11.08.2020 21:15:10
- Zuletzt bearbeitet 21.11.2024 05:08:13
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Logindjango-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Django-celery-results Project ≫ Django-celery-results Version <= 1.2.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.86% | 0.538 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 5 | 10 | 2.9 |
AV:N/AC:L/Au:N/C:P/I:N/A:N
|
CWE-312 Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
https://github.com/celery/django-celery-results/issues/142