CVE-2018-16987

HIGH

Squash TM <1.18.0 - Info Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-16987. PoCs published by gquere.

AI-analyzed exploit summary This repository documents CVE-2018-16987, a cleartext storage and exposure of sensitive information vulnerability in Squash TM. The vulnerability allows admin users to view cleartext passwords of external services in the administration panel, indicating improper storage practices.

Description

Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code.

Exploits (1)

nomisec WRITEUP 1 stars
by gquere · poc
https://github.com/gquere/CVE-2018-16987

This repository documents CVE-2018-16987, a cleartext storage and exposure of sensitive information vulnerability in Squash TM. The vulnerability allows admin users to view cleartext passwords of external services in the administration panel, indicating improper storage practices.

Classification
Writeup 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Squash TM through at least 1.18.0
Auth required
Prerequisites: Admin access to Squash TM
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Mailing List, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2018/09/13/1
Permissions Required, Vendor Advisory x_refsource_misc
https://ci.squashtest.org/mantis/view.php?id=7553

Scores

CVSS v3 7.2
EPSS 0.0130
EPSS Percentile 66.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-522
Status published
Products (1)
squashtest/squash_tm < 1.18.0
Published Sep 13, 2018
Tracked Since Feb 18, 2026