CVE-2019-20150 - CVE House
Back to Database
Status published Medium CVE-2019-20150

In TreasuryXpress 19191105, a logged-in user can discover saved credentials,...

Vulnerability Description

In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's editor to change the expected SFTP Host IP to a malicious host, and then using the Check Connectivity option. The application then sends these saved credentials to the malicious host.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-20150

Credits & Attribution

No credits recorded in the NVD database.

References

More from treasuryxpress

View All →
CVE-2019-20152
An XSS issue was discovered in TreasuryXpress 19191105. Due to...
Medium 6.1
CVE-2019-20151
An XSS issue was discovered in TreasuryXpress 19191105. Due to...
Medium 6.1
CVE-2015-4626
B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which...
High 7.5

Affected Vendor

treasuryxpress

View all reports →

Affected Software

treasuryxpress
Vulnerable Versions:
19191105

Timeline

Official Publish: August 20th, 2020
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.