CVE-2018-17944

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-179466.1The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupda CVE-2018-179476.1The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.CVE-2018-179486.1An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3.CVE-2018-179496.1Cross site scripting vulnerability in iManager prior to 3.1 SP2.CVE-2018-17956.1IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users CVE-2018-179507.5Incorrect enforcement of authorization checks in eDirectory prior to 9.1 SP2 CVE-2018-179526.1Cross site scripting vulnerability in eDirectory prior to 9.1 SP2 CVE-2018-179538.1A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 c CVE-2018-179547.8An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud CVE-2018-179555.5In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink pro CVE-2018-179567.8In yast2-samba-provision up to and including version 1.0.1 the password for samba shares was provided on the command line to tools used by y CVE-2018-179577.8The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process comma