Description
Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11 and 1.24.03.
References (2)
Core 2
Core References
Government Resource government-resource
https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1611
Third Party Advisory government-resource
broken-link
https://www.usom.gov.tr/bildirim/tr-24-1611
Scores
CVSS v3
7.5
EPSS
0.0061
EPSS Percentile
44.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-202
CWE-312
Status
published
Products (6)
finrota/finrota
< 1.21.10
Finrota/Netahsilat
1.21.10
Finrota/Netahsilat
1.23.01
Finrota/Netahsilat
1.23.08
Finrota/Netahsilat
1.23.11
Finrota/Netahsilat
1.24.03
Published
Oct 04, 2024
Tracked Since
Feb 18, 2026