CVE-2023-28441
smartCARS 3 Password Stored as plain text in Error Log
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 8EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
23 Mar 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Affected products
invernyx · smartcars-3-bugsWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →