6.5

CVE-2023-4984

Exploit

didi KnowSearch 1 credentials storage

A vulnerability was found in didi KnowSearch 0.3.2/0.3.1.2. It has been rated as problematic. This issue affects some unknown processing of the file /api/es/admin/v3/security/user/1. The manipulation leads to unprotected storage of credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-239795.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Didiglobal ≫ Knowsearch Version0.3.1.2
Didiglobal ≫ Knowsearch Version0.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.52% 0.402
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
cna@vuldb.com 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cna@vuldb.com 4 8 2.9
AV:N/AC:L/Au:S/C:P/I:N/A:N
CWE-256 Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

https://github.com/didi/KnowSearch/files/12135597/ad1aa7b3-ecee-44b0-a22a-80917ca0fe71.pdf4398935202801712312.pdf
Exploit
https://github.com/didi/KnowSearch/issues/86
Exploit
Issue Tracking
https://vuldb.com/?ctiid.239795
Third Party Advisory
https://vuldb.com/?id.239795
Third Party Advisory