Description
CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x.
References (1)
Core 1
Core References
Mitigation, Vendor Advisory
https://support1.cloverdx.com/hc/en-us/articles/8484869595164-Security-advisory-April-2023
Scores
CVSS v3
9.1
EPSS
0.0018
EPSS Percentile
38.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-532
Status
published
Products (3)
cloverdx/cloverdx
5.16.0
cloverdx/cloverdx
5.16.1
cloverdx/cloverdx
5.14.0 - 5.14.3
Published
Apr 24, 2023
Tracked Since
Feb 18, 2026