PT-2019-12986 · Jetbrains · Jetbrains Hub

Publicado 2019-07-03 · Atualizado 2020-08-24 · CVE-2019-12847

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JetBrains Hub versions prior to 2018.4.11298

Description The issue allows audit events for SMTPSettings to display a cleartext password to the admin user. This is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period.

Recommendations For versions prior to 2018.4.11298, update to version 2018.4.11298 or later to resolve the issue. As a temporary workaround, consider changing passwords that have not been updated since 2017 and clearing or restricting access to old audit log events.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-12847

Produtos afetados

Jetbrains Hub

Referências · 3

• https://blog.jetbrains.com/blog/2019/06/19/jetbrains-security-bulletin-q1-2019 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-12847 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12847 · Aviso do Fabricante