CVE-2023-37468

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-374698.8CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connec CVE-2023-37475.5Zero Trust Administrators have the ability to disallow end users from disabling WARP on their devices. Override codes can also be created by CVE-2023-374709.8Metabase is an open-source business intelligence and analytics platform. Prior to versions 0.43.7.3, 0.44.7.3, 0.45.4.3, 0.46.6.4, 1.43.7.3,CVE-2023-374719.8Open Access Management (OpenAM) is an access management solution that includes Authentication, SSO, Authorization, Federation, Entitlements CVE-2023-374726.5Knowage is an open source suite for business analytics. The application often use user supplied data to create HQL queries without prior san CVE-2023-374738.8zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing _callable strings_ (ie `system`) caused th CVE-2023-374747.5Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the `.cpr` subfolder.CVE-2023-374757.5Hamba avro is a go lang encoder/decoder implementation of the avro codec specification. In affected versions a well-crafted string passed to CVE-2023-374767.8OpenRefine is a free, open source tool for data processing. A carefully crafted malicious OpenRefine project tar file can be used to trigger CVE-2023-374778.81Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel fir CVE-2023-374789.8pnpm is a package manager. It is possible to construct a tarball that, when installed via npm or parsed by the registry is safe, but when in CVE-2023-374797.5Open Enclave is a hardware-agnostic open source library for developing applications that utilize Hardware-based Trusted Execution Environmen