CVE-2023-37468
MediumCVSS 6.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Feedbacksystem stores passwords of users using LDAP login in clear text in the database. This issue occurs during the first login when the password is transmitted unencrypted.
Risk Assessment
Storing passwords in plain text poses a serious risk of data leakage and unauthorized access to user accounts. Organizations may be vulnerable to attacks that could lead to account compromise.
Recommendation
It is recommended to update the system to version 1.19.2, where the issue has been patched. Additionally, implementing password encryption in the database and using secure data transmission methods is advisable.
Original NVD description (English source)
Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.