Sensitive Information Disclosure in Apache Jackrabbit Oak by Apache

CVE-2020-1940

What is CVE-2020-1940?

The Apache Jackrabbit Oak before version 1.22.0 contains a vulnerability that may allow sensitive information disclosure. This occurs when the system mandates that a changed password be included as an additional attribute in the credentials object. However, this attribute is not removed during the initial phase of authentication processing. If multiple authentication methods are used, it could potentially expose the new password, thereby compromising the security of user accounts.

References