CVE-2026-48243

Katalog CVE

CVSS 5.3 · Medium EPSS 0,38%

Kerentanan Use of Hard-coded Credentials. Skor CVSS 3.1 5.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can extract the key and use it to make third-party API calls billed to or rate-limited against the original owner's WhitePages account.

Rincian

Terbit di NVD

21 Mei 2026

Terakhir diubah

20 Juli 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/openises/tickets/commit/ecfeb406a016766cae81c749e14b5145a9f2dbff
• https://github.com/openises/tickets/releases/tag/v3.44.2
• https://www.vulncheck.com/advisories/open-ises-tickets-hardcoded-whitepages-api-key-in-wp1-php