CVE-2024-6400: Cleartext Storage of Username and Password in Finrota's Netahsilat

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-04 · updated 2026-06-17
Weakness: CWE-202

Description

Cleartext Storage of Sensitive Information, Exposure of Sensitive Information Through Data Queries vulnerability in Finrota Netahsilat allows Retrieve Embedded Sensitive Data, Authentication Bypass, IMAP/SMTP Command Injection, Collect Data from Common Resource Locations. This issue solved in versions 1.21.10, 1.23.01, 1.23.08, 1.23.11 and 1.24.03.

Affected products

Finrota: before 1.21.10 — fixed in 1.21.10

How to fix

Upgrade to a fixed version: Finrota 1.21.10. Check the vendor advisory for mitigations.

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-24-1611
https://www.usom.gov.tr/bildirim/tr-24-1611

Get alerted when CVE-2024-6400 or the next vulnerability affects your stack