Cyber Resilience

CVE-2021-39342

Medium

Published: 29 September 2021

Published
29 September 2021
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0013 32.2th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-39342 is a medium-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Credova Financial. Its CVSS base score is 5.3 (Medium).

Operationally, ranked at the 32.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The Credova_Financial WordPress plugin discloses a site's associated Credova API account username and password in plaintext via an AJAX action whenever a site user goes to checkout on a page that has the Credova Financing option enabled. This affects versions…

more

up to, and including, 1.4.8.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

credova
financial
≤ 1.4.9

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-319 CWE-522

Sensitive values are moved off the primary channel, avoiding cleartext transmission risks associated with that channel.

addresses: CWE-522

Training instructs users on protecting credentials from disclosure or unauthorized access.

addresses: CWE-319

Role-based training covers secure transmission methods, mitigating cleartext transmission of sensitive data.

addresses: CWE-522

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

addresses: CWE-319

By requiring documented security controls for information exchanges, the control reduces the risk of cleartext transmission of sensitive data.

addresses: CWE-319

Mapping transmission actions in data flows helps prevent cleartext transmission of sensitive information.

addresses: CWE-319

Settings can enforce secure transmission protocols to prevent cleartext transmission of sensitive data.

addresses: CWE-522

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

References