phpRank 1.8 stores the administrative password in plaintext on the server and in the "ap" cookie, which allows remote attackers to retrieve the administrative password.
Threat-Mapped Scoring
Score: 3.0
Priority: P2 - Serious (High)
S1 – Steal Customer Account Information
EPSS
Score: 0.00263 Percentile:
0.49588
CVSS Scoring
CVSS v3.1 Score: 7.5
Severity: HIGH
Mapped CWE(s)
CWE-312
: Cleartext Storage of Sensitive Information
All CAPEC(s)
CAPEC-37: Retrieve Embedded Sensitive Data
CAPEC(s) with Mapped TTPs
CAPEC-37: Retrieve Embedded Sensitive Data
Mapped TTPs: