CVE-2019-12847 Information disclosure in n/a
Administrators can view cleartext SMTP passwords in audit logs if passwords were unchanged since 2017 and old logs remain.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-12847?
CVE-2019-12847 is a high-severity vulnerability in n/a, published on 3 Jul 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period.
Weakness: CWE-522
Which versions are affected by CVE-2019-12847?
It affects 1 product.
Products include Jetbrains Hub.
How do I fix CVE-2019-12847?
No fix has been published for CVE-2019-12847 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-12847 being exploited?
There is no known exploitation of CVE-2019-12847 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-3h7w-w4qf-f3pr.