CVE-2019-20150

Name of the Vulnerable Software and Affected Versions TreasuryXpress version 19191105

Description The issue allows a logged-in user to discover saved credentials, which are hidden by the UI. An attacker can exploit this by using the application's editor to change the expected SFTP Host IP to a malicious host and then using the Check Connectivity option. This forces the application to send the saved SSH/SFTP credentials to the malicious host.

Recommendations For TreasuryXpress version 19191105, as a temporary workaround, consider restricting access to the editor functionality that allows changing the SFTP Host IP, and avoid using the Check Connectivity option with untrusted hosts until a patch is available.