PT-2023-21724 · Unknown · Smartcars 3

Jishwaah · Published 2023-03-23 · Updated 2023-03-28 · CVE-2023-28441

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions smartCARS 3 versions 0.5.8 and prior

Description The issue affects smartCARS 3, a flight tracking software. In the affected versions, failed login attempts result in passwords being stored in error logs. This does not occur in version 0.5.9.

Recommendations For versions 0.5.8 and prior, as a workaround, delete the affected log file and ensure correct login to prevent password storage in error logs. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it is known that version 0.5.9 does not have this problem.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2023-28441

GHSA-FP42-C8G2-5JC7

Affected Products

Smartcars 3

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28441.json · Exploit
• https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-fp42-c8g2-5jc7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-28441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-28441 · Security Note
• https://t.me/cibsecurity/60636 · Telegram Post