CVE-2020-9425

Katalog CVE

CVSS 7.5 · High EPSS 19,0%

Kerentanan Always-Incorrect Control Flow Implementation pada rconfig. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response.

Rincian

Terbit di NVD

20 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

EPSS (30 hari)

19,0% peluang dieksploitasi; lebih tinggi dari 97,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/rconfig/rconfig/commit/20f4e3d87e84663d922b937842fddd9af1b68dd9 patch · advisory pihak ketiga
• https://blog.hivint.com/rconfig-3-9-3-unauthenticated-sensitive-information-disclosure-ead4ed88f153 exploit · advisory pihak ketiga