CVE-2018-16987 Information disclosure in n/a
Squash TM exposes cleartext passwords for external services in the administration panel, allowing attackers to read sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16987?
CVE-2018-16987 is a high-severity vulnerability in n/a, published on 13 Sep 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code.
Weakness: CWE-522
Which versions are affected by CVE-2018-16987?
It affects 1 product.
Products include Squashtest Squash Tm.
How do I fix CVE-2018-16987?
No fix has been published for CVE-2018-16987 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-16987 being exploited?
There is no known exploitation of CVE-2018-16987 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-vvwm-p952-78ch.