GitHub Advisoryadvisory · Maven

GHSA-3h68-wvv6-8r5h Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak

HIGH Published 2021-12-10 Modified 2021-07-28 Official page ↗
Aliases
CVE-2020-1940
Ecosystem
Maven
Packages
org.apache.jackrabbit:oak-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-212
Reviewed
2021-03-29

Affected packages

• Maven org.apache.jackrabbit:oak-core: >= 1.12.0, < 1.24.0 → fixed in 1.24.0 • Maven org.apache.jackrabbit:oak-core: >= 1.10.0, < 1.10.8 → fixed in 1.10.8

Description

The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.

Related

Alias · CVE (1)

  • CVE-2020-1940 The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer weakness

References