Description (CNA)
ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other vulnerabilities (e.g., XSS, IDOR, session fixation), enabling attackers to harvest other users’ passwords. Version 6.5.0 fixes the issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| ChurchCRM / CRM | affected < 6.5.0 |
CWE
CWE-204
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p98h-5xcj-5c6x
- https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd
ADP enrichment
No English description supplied.
No references supplied.