CVE-2021-3130 Information disclosure in n/a

Medium 5.9 Published 20 Jan 2021 Updated 3 Aug 2024

Attackers can view hidden SSH, Windows, and SNMP credentials in Open-AudIT by inspecting HTML password fields via developer tools.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-3130?

CVE-2021-3130 is a medium-severity vulnerability in n/a, published on 20 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Within the Open-AudIT up to version 3.5.3 application, the web interface hides SSH secrets, Windows passwords, and SNMP strings from users using HTML 'password field' obfuscation. By using Developer tools or similar, it is possible to change the obfuscation so that the credentials are visible.

Which versions are affected by CVE-2021-3130?

It affects 1 product.

Products include Opmantek Open-Audit.

How do I fix CVE-2021-3130?

No fix has been published for CVE-2021-3130 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-3130 being exploited?

There is no known exploitation of CVE-2021-3130 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Sources

Also known as GHSA-qpq8-7ff2-687p.