Vulnerability Description
The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Jackrabbit Oak | >= 1.2.0, <= 1.22.0 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2020/01/28/1Mailing ListPatchThird Party Advisory
- https://lists.apache.org/thread.html/r3da8e2fd253ecd4d3a0de71ce255631148b54be850
- https://lists.apache.org/thread.html/r45b0e2fb6ac51c5a03952b08b5e0efde1249ecb809
- https://lists.apache.org/thread.html/r601637e38ee743e845856a4e24915cb8db26ae80ca
- https://lists.apache.org/thread.html/ra295f919586b19def7cc7713d9d78595507d5f7033
- https://lists.apache.org/thread.html/ra6b3e78f5ed545c1d859d664f66c6d3fc5d731d9b1
- https://lists.apache.org/thread.html/rb3023cfd45441b570c1abaa347d0cac78df97b5d3f
- https://lists.apache.org/thread.html/rba884dbe733781cbaaffa28b77bc37a6a9f948b3a7
- https://lists.apache.org/thread.html/rbef4701b5ce4d827182e70ad7b4d987a9157682ba3
- https://lists.apache.org/thread.html/rc35a57ecdeae342d46f729d6bc9750ba860c101f45
- https://lists.apache.org/thread.html/rccc0ed467faa35734ea16b8f5de5603e708936c41a
- https://lists.apache.org/thread.html/rccc0ed467faa35734ea16b8f5de5603e708936c41aMailing ListRelease NotesVendor Advisory
- http://www.openwall.com/lists/oss-security/2020/01/28/1Mailing ListPatchThird Party Advisory
- https://lists.apache.org/thread.html/r3da8e2fd253ecd4d3a0de71ce255631148b54be850
- https://lists.apache.org/thread.html/r45b0e2fb6ac51c5a03952b08b5e0efde1249ecb809
FAQ
What is CVE-2020-1940?
CVE-2020-1940 is a vulnerability with a CVSS score of 7.5 (HIGH). The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates ...
How severe is CVE-2020-1940?
CVE-2020-1940 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1940?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Jackrabbit Oak.