CVE-2020-19137

HIGH

autumn < 1.0.4 - Unauthenticated Cleartext Storage of Sensitive Information via User API

Title source: llm

Description

Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllUser/?page=1&limit=10".

References (1)

Core 1

Core References

Exploit, Issue Tracking, Patch, Third Party Advisory x_refsource_misc

https://github.com/ShuaiJunlan/Autumn/issues/82

Scores

CVSS v3 7.5

EPSS 0.0091

EPSS Percentile 55.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-312

Status published

Products (1)

autumn_project/autumn < 1.0.4

Published Sep 08, 2021

Tracked Since Feb 18, 2026