CVE-2022-47880
MediumCVSS 5.3Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
An information disclosure vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote, authenticated users with permissions to modify database connections to disclose a connection's cleartext password via the 'test connection' function.
Risk Assessment
The risk involves potential exposure of database passwords to privileged users, which could lead to unauthorized access to sensitive data.
Recommendation
It is recommended to immediately update Jedox to the latest version and restrict permissions to modify database connections to trusted administrators only.
Original NVD description (English source)
An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.