ByteOS Network

Vulnerability Details :

CVE-2019-8118

Assigner-adobe

Assigner Org ID-078d4453-3bcd-4900-85e6-15281da43538

Published At-05 Nov, 2019 | 22:49

Updated At-04 Aug, 2024 | 21:10

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:adobe

Assigner Org ID:078d4453-3bcd-4900-85e6-15281da43538

Published At:05 Nov, 2019 | 22:49

Updated At:04 Aug, 2024 | 21:10

▼CVE Numbering Authority (CNA)

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.

Affected Products

Vendor

Adobe Inc.

Product

Magento 2

Versions

Affected

Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p2

Problem Types

Type	CWE ID	Description
text	N/A	Cryptographic Flaw

Type: text

CWE ID: N/A

Description: Cryptographic Flaw

References

Hyperlink	Resource
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update	x_refsource_MISC

Hyperlink: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update	x_refsource_MISC x_transferred

Hyperlink: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:psirt@adobe.com

Published At:05 Nov, 2019 | 23:15

Updated At:08 Nov, 2019 | 19:04

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 5.3

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

magento>>magento>>Versions from 2.1.0(inclusive) to 2.1.19(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

magento>>magento>>Versions from 2.1.0(inclusive) to 2.1.19(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*

magento>>magento>>Versions from 2.2.0(inclusive) to 2.2.10(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

magento>>magento>>Versions from 2.2.0(inclusive) to 2.2.10(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*

magento>>magento>>Versions from 2.3.0(inclusive) to 2.3.2(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

magento>>magento>>Versions from 2.3.0(inclusive) to 2.3.2(exclusive)

cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*

magento>>magento>>2.3.2

cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*

magento>>magento>>2.3.2

cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-312	Primary	nvd@nist.gov

CWE ID: CWE-312

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update	psirt@adobe.com	Patch Vendor Advisory

Hyperlink: https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Source: psirt@adobe.com

Resource:

Patch

Vendor Advisory

Similar CVEs

156Records found

CVE-2021-31817

Matching Score-4

Assigner-Octopus Deploy

View Details

Matching Score-4

Assigner-Octopus Deploy

CVSS Score-7.5||HIGH

EPSS-0.16% / 36.90%

7 Day CHG~0.00%

Published-08 Jul, 2021 | 10:43

Updated-03 Aug, 2024 | 23:10

When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is written to the OctopusServer.txt log file in plaintext.

Vendor-Octopus Deploy Pty. Ltd.

Product-server Octopus Server

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2020-19137

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-7.5||HIGH

EPSS-0.13% / 33.14%

7 Day CHG~0.00%

Published-08 Sep, 2021 | 20:18

Updated-04 Aug, 2024 | 14:08

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".

Vendor-autumn_project n/a

Product-autumn n/a

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2024-43429

Matching Score-4

Assigner-Fedora Project

View Details

Matching Score-4

Assigner-Fedora Project

CVSS Score-5.3||MEDIUM

EPSS-0.08% / 23.76%

7 Day CHG+0.01%

Published-11 Nov, 2024 | 12:15

Updated-01 May, 2025 | 16:07

Moodle: user information visibility control issues in gradebook reports

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

Vendor-Moodle Pty Ltd

Product-moodle moodle

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2020-8225

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-7.5||HIGH

EPSS-1.30% / 78.94%

7 Day CHG~0.00%

Published-18 Sep, 2020 | 20:11

Updated-04 Aug, 2024 | 09:56

A cleartext storage of sensitive information in Nextcloud Desktop Client 2.6.4 gave away information about used proxies and their authentication credentials.

Vendor-n/a Nextcloud GmbH

Product-desktop Desktop Client

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2020-5723

Matching Score-4

Assigner-Tenable Network Security, Inc.

View Details

Matching Score-4

Assigner-Tenable Network Security, Inc.

CVSS Score-9.8||CRITICAL

EPSS-50.76% / 97.77%

7 Day CHG~0.00%

Published-30 Mar, 2020 | 19:03

Updated-04 Aug, 2024 | 08:39

The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.

Vendor-grandstream n/a

Product-ucm6202_firmware ucm6204_firmware ucm6208_firmware ucm6202 ucm6204 ucm6208 Grandstream UCM6200 series

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2020-3921

Matching Score-4

Assigner-TWCERT/CC

View Details

Matching Score-4

Assigner-TWCERT/CC

CVSS Score-8.6||HIGH

EPSS-0.18% / 40.24%

7 Day CHG~0.00%

Published-27 Mar, 2020 | 03:50

Updated-17 Sep, 2024 | 02:15

Unisoon UltraLog Express - Sensitive Data Exposure

UltraLog Express device management software stores user’s information in cleartext. Any user can obtain accounts information through a specific page.

Vendor-unisoon Unisoon unisoon

Product-ultralog_express_firmware ultralog_express UltraLog Express ultralog_express_firmware

CWE ID-CWE-312

Cleartext Storage of Sensitive Information

CVE-2019-8118

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs