CVE-2019-17397

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://pastebin.com/hGg5efMeExploit, Third Party Advisory
https://pastebin.com/hGg5efMeExploit, Third Party Advisory

Timeline

Published: Oct 15, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-173989.8In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log du CVE-2019-173999.8The Shack Forms Pro extension before 4.0.32 for Joomla! allows path traversal via a file attachment.CVE-2019-17408.6A vulnerability in the Network-Based Application Recognition (NBAR) feature of Cisco IOS Software and Cisco IOS XE Software could allow an u CVE-2019-174007.5The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.CVE-2019-174013.3libyal liblnk 20191006 has a heap-based buffer over-read in the network_share_name_offset>20 code block of liblnk_location_information_read_CVE-2019-174026.5Exiv2 0.27.2 allows attackers to trigger a crash in Exiv2::getULong in types.cpp when called from Exiv2::Internal::CiffDirectory::readDirect CVE-2019-174038.8Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution.CVE-2019-174044.3Nokia IMPACT < 18A: allows full path disclosure CVE-2019-174056.1Nokia IMPACT < 18A: has Reflected self XSS CVE-2019-174065.3Nokia IMPACT < 18A has path traversal that may lead to RCE if chained with CVE-2019-1743 CVE-2019-174089.8parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key functi CVE-2019-174096.1Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.