CVEvulnerability
CVE-2026-90940
6.9 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-14
- Last modified
- 2026-09-23
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 6.9 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-1392
Description
novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint that allows anonymous attackers to invalidate portal caches by supplying the hardcoded default value in the URL path. Attackers can trigger unauthorized cache invalidation by accessing the cache/refresh endpoint with the known default password, forcing unnecessary database queries to repopulate the cache.
Related
Weakness · CWE (1)
- CWE-1392 Use of Default Credentials weakness
References
- https://github.com/201206030/novel-plus github.com
- https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/java/com/java2nb/novel/controller/CacheController.java github.com
- https://github.com/201206030/novel-plus/blob/d63c3ee394657046ebd469e263532a350a60e930/novel-front/src/main/resources/application.yml github.com
- https://github.com/201206030/novel-plus/releases/tag/v5.3.3 github.com
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/novel-plus/poc-07-front-cache-refresh-hardcoded-password.py github.com
- https://www.vulncheck.com/advisories/novel-plus-through-5.3.3-default-cache-management-password-in-the-front-portal www.vulncheck.com