CVE-2020-1940

{"id": "CVE-2020-1940", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-01-28T17:15:12.193", "references": [{"url": "http://www.openwall.com/lists/oss-security/2020/01/28/1", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r3da8e2fd253ecd4d3a0de71ce255631148b54be8500225b5812f7737%40%3Coak-commits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r45b0e2fb6ac51c5a03952b08b5e0efde1249ecb809884cc87eb0bd99%40%3Ccommits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/r601637e38ee743e845856a4e24915cb8db26ae80ca782bef91989cbc%40%3Coak-commits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/ra295f919586b19def7cc7713d9d78595507d5f703362fccb779eeeb9%40%3Coak-commits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/ra6b3e78f5ed545c1d859d664f66c6d3fc5d731d9b1d842349654e4f0%40%3Ccommits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rb3023cfd45441b570c1abaa347d0cac78df97b5d3f27d674d01b3d2a%40%3Ccommits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rba884dbe733781cbaaffa28b77bc37a6a9f948b3a72a1bdad5e1587c%40%3Ccommits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rbef4701b5ce4d827182e70ad7b4d987a9157682ba3643e05a9ef5a7b%40%3Ccommits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rc35a57ecdeae342d46f729d6bc9750ba860c101f450cc171798dba28%40%3Coak-commits.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rccc0ed467faa35734ea16b8f5de5603e708936c41a4eddd90fddeaf0%40%3Cannounce.jackrabbit.apache.org%3E", "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread.html/rccc0ed467faa35734ea16b8f5de5603e708936c41a4eddd90fddeaf0%40%3Cusers.jackrabbit.apache.org%3E", "tags": ["Mailing List", "Release Notes", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-212"}]}], "descriptions": [{"lang": "en", "value": "The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed."}, {"lang": "es", "value": "Las funcionalidades opcionales de cambio de contrase\u00f1a inicial y caducidad de contrase\u00f1a presentes en Apache Jackrabbit Oak versiones 1.2.0 hasta 1.22.0, son propensas a una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n confidencial. El c\u00f3digo exige que la contrase\u00f1a modificada sea pasada como un atributo adicional al objeto de credenciales, pero no la elimina durante el procesamiento en la primera fase de la autenticaci\u00f3n. En combinaci\u00f3n con mecanismos de autenticaci\u00f3n adicionales e independientes, esto puede conllevar a que se revele la nueva contrase\u00f1a."}], "lastModified": "2023-11-07T03:19:37.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:jackrabbit_oak:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CFA05B8-7B97-4965-988A-AEFF7C719FE3", "versionEndIncluding": "1.22.0", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}