CVE-2008-2368

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-20 · updated 2026-06-16
Weakness: CWE-255

Description

Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.

Affected products

Red Hat Certificate System: 7.2

References

http://secunia.com/advisories/33540
http://securitytracker.com/id?1021608
http://www.securityfocus.com/bid/33288
http://www.vupen.com/english/advisories/2009/0145
https://bugzilla.redhat.com/show_bug.cgi?id=452000
https://exchange.xforce.ibmcloud.com/vulnerabilities/48022
https://rhn.redhat.com/errata/RHSA-2009-0006.html
https://rhn.redhat.com/errata/RHSA-2009-0007.html
http://secunia.com/advisories/33540
http://securitytracker.com/id?1021608
http://www.securityfocus.com/bid/33288
http://www.vupen.com/english/advisories/2009/0145

Get alerted when CVE-2008-2368 or the next vulnerability affects your stack