CVE-2023-28441: smartCARS 3 Password Stored as plain text in Error Log

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-24 · updated 2026-06-17
Weakness: CWE-532

Description

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly.

Affected products

invernyx smartcars-3-bugs: before 0.5.9 — fixed in 0.5.9

How to fix

Upgrade to a fixed version: invernyx smartcars-3-bugs 0.5.9. Check the vendor advisory for mitigations.

References

https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-fp42-c8g2-5jc7
https://github.com/invernyx/smartcars-3-bugs/security/advisories/GHSA-fp42-c8g2-5jc7

Get alerted when CVE-2023-28441 or the next vulnerability affects your stack