CVE-2023-37468

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c7704426325bcf	Patch
https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2	Release Notes
https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:thm:feedbacksystem:*:*:*:*:*:*:*:*

History

25 Jul 2023, 18:35

Type	Values Removed	Values Added
CPE		cpe:2.3:a:thm:feedbacksystem::::::::
First Time		Thm feedbacksystem Thm
References	~~(MISC) https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c7704426325bcf -~~	(MISC) https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c7704426325bcf - Patch
References	~~(MISC) https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349 -~~	(MISC) https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349 - Vendor Advisory
References	~~(MISC) https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2 -~~	(MISC) https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2 - Release Notes
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5

13 Jul 2023, 21:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-07-13 21:15

Updated : 2024-02-28 20:33

NVD link : CVE-2023-37468

Mitre link : CVE-2023-37468

CVE.ORG link : CVE-2023-37468

JSON object : View

Products Affected

thm

feedbacksystem

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2023-37468", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 1.5}]}, "published": "2023-07-13T21:15:09.253", "references": [{"url": "https://github.com/thm-mni-ii/feedbacksystem/commit/8d896125263e1efb1b70990987c7704426325bcf", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/thm-mni-ii/feedbacksystem/releases/tag/v1.9.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/thm-mni-ii/feedbacksystem/security/advisories/GHSA-g28r-8wg3-7349", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.\n\n"}, {"lang": "es", "value": "Feedbacksystem es un sistema de feedback personalizado para estudiantes que utiliza inteligencia artificial. Las contrase\u00f1as de los usuarios que utilizan el login LDAP se almacenan en texto claro en la base de datos. La contrase\u00f1a de los usuarios LDAP se pasa sin cifrar en el \"LoginController.scala\" y se almacena en la base de datos cuando se inicia sesi\u00f3n por primera vez. Los usuarios que utilizan s\u00f3lo el inicio de sesi\u00f3n local o el inicio de sesi\u00f3n cas no se ven afectados. Este problema ha sido corregido en la versi\u00f3n 1.19.2. "}], "lastModified": "2023-07-25T18:35:42.230", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:thm:feedbacksystem:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC3297F4-C7E7-407D-9099-5FC637CE8E14", "versionEndExcluding": "1.9.2", "versionStartIncluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}