Main Vulnerability Database Vulnerabilities #VU24935

Information disclosure in Apache Jackrabbit Oak - CVE-2020-1940

Published: February 5, 2020

Vulnerability identifier: #VU24935

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1940

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to an error in the optional initial password change and password expiration features. The code mandates the changed password to be passed as an additional attribute to the credentials object, but does not remove it upon processing during the first phase of the authentication. A remote attacker can gain unauthorized access to sensitive information on the system.

Affected software

Apache Jackrabbit Oak

How to mitigate CVE-2020-1940

Install updates from vendor's website.

Apache Jackrabbit Oak - addressed in versions 1.10.8, 1.24.0

External References

Related Security Bulletins