Storing unencrypted LDAP passwords in feedbacksystem
Priority LOW 26CWE-312Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.
Summary
Feedbacksystem is a personalized feedback system for students using artificial intelligence. Passwords of users using LDAP login are stored in clear text in the database. The LDAP users password is passed unencrypted in the LoginController.scala and stored in the database when logging in for the first time. Users using only local login or the cas login are not affected. This issue has been patched in version 1.19.2.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed feedbacksystem (thm-mni-ii): 1.19.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| thm-mni-ii | feedbacksystem | 1.5.0 to before 1.19.2 | 1.19.2 | Patch available | CNA |
- feedbacksystem Vendorthm-mni-ii Affected 1.5.0 to before 1.19.2 Fixed in 1.19.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:thm:feedbacksystem:*:*:*:*:*:*:*:* | 1.5.0 to before 1.9.2 | Vulnerable | THM-Health |
- cpe:2.3:a:thm:feedbacksystem:*:*:*:*:*:*:*:* Versions 1.5.0 to before 1.9.2 Vulnerable ·THM-Health
Remediation
- Fix · CNA feedbacksystem (thm-mni-ii) Fixed in 1.19.2
Timeline
- 2026-10-02 Threatist record created from CVE-2023-37468
References
More THM-Health Feedbacksystem vulnerabilities
- TI-2023-12213 Insufficient verification of authorisation when accessing subresults in thmmniii/fbs-core CVSS 3.1MEDIUM 4.3
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences