CVE-2026-13380

Katalog CVE

CVSS 7.5 · High EPSS 0,39%

Kerentanan Insertion of Sensitive Information Into Sent Data pada vsee clinic, vsee clinic api. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

14 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data
CWE-312: Cleartext Storage of Sensitive Information

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://labs.sra.io/posts/vseeclinic advisory pihak ketiga
• https://vsee.com/clinic product