CVE-2025-54876
BaseFortify
Publication date: 2025-08-06
Last updated on: 2025-08-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| janssenproject | jans | 1.10.0 |
| janssenproject | jans | 1.9.0 |
| janssenproject | jans | 5.9.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the Janssen Project, an open-source identity and access management platform, storing user passwords in plaintext within the local cli_cmd.log file in versions 1.9.0 and below. This means that sensitive password information is not encrypted or protected, making it accessible to anyone who can read the log file. The issue has been fixed in the nightly prerelease version.
How can this vulnerability impact me? :
The impact of this vulnerability is that attackers or unauthorized users who gain access to the local cli_cmd.log file can obtain user passwords in plaintext. This can lead to unauthorized access to user accounts, potential identity theft, and compromise of systems relying on the Janssen Project for identity and access management.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
Storing passwords in plaintext violates best practices for protecting sensitive data and can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require appropriate safeguards to protect personal and sensitive information. This vulnerability could therefore result in regulatory penalties and increased risk of data breaches.
What immediate steps should I take to mitigate this vulnerability?
Upgrade Janssen Project to a version later than 1.9.0 or use the nightly prerelease where the issue of storing passwords in plaintext in the local cli_cmd.log file is fixed. Additionally, avoid using versions 1.9.0 and below to prevent exposure of plaintext passwords.