Medium severity6.5NVD Advisory· Published Aug 20, 2020· Updated Jun 17, 2026
CVE-2019-20150
CVE-2019-20150
Description
In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's editor to change the expected SFTP Host IP to a malicious host, and then using the Check Connectivity option. The application then sends these saved credentials to the malicious host.
Affected products
3cpe:2.3:a:treasuryxpress:treasuryxpress:19191105:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:treasuryxpress:treasuryxpress:19191105:*:*:*:*:*:*:*
- (no CPE)range: 19191105
- TreasuryXpress/TreasuryXpressdescription
Patches
Vulnerability mechanics
References
1- sion-evans.com/blog/CVE-2019-20150.htmlnvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.