CVE-2019-7690 Information disclosure in n/a
Attackers with memory access can retrieve SSH private keys and passwords from MobaXterm process memory, compromising remote server access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7690?
CVE-2019-7690 is a critical vulnerability in n/a, published on 13 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In MobaTek MobaXterm Personal Edition v11.1 Build 3860, the SSH private key and its password can be retrieved from process memory for the lifetime of the process, even after the user disconnects from the remote SSH server. This affects Passwordless Authentication that has a Password Protected SSH Private Key.
Weakness: CWE-255
Which versions are affected by CVE-2019-7690?
It affects 1 product.
Products include Mobatek Mobaxterm.
How do I fix CVE-2019-7690?
No fix has been published for CVE-2019-7690 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-7690 being exploited?
There is no known exploitation of CVE-2019-7690 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7w57-wp3w-8gq9.