Unscored severity · published Jan 20, 2009
CVE-2008-2368
Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak…
–
CVSS
0.2%
EPSS
No
On KEV
Description
Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Certificate System · Redhat
7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2368
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2368
Vendor Advisory
http://secunia.com/advisories/33540
securitytracker.com
http://securitytracker.com/id?1021608
www.securityfocus.com
http://www.securityfocus.com/bid/33288
www.vupen.com
http://www.vupen.com/english/advisories/2009/0145
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=452000
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/48022
More from Certificate System
8.1
CVE-2021-20179
A flaw was found in pki-core
6.5
CVE-2017-7509
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1
5.7
CVE-2022-2393
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled
5.4
CVE-2020-1696
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting…
4.8
CVE-2019-10180
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly…