Skip to main content

Cleartext Storage of Sensitive Information

CVE-2024-56362

Medium
5.5/10

Summary

Navidrome is an open-source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the "navidrome.db" database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. This issue affects the package github.com/navidrome/navidrome versions prior to 0.54.1.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-312 - Cleartext Storage of Sensitive Information

The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References

Advisory Timeline

  • Published