🔴 《严重安全漏洞：CVE-2026-13380》

CVSS 评分: 严重（9.0）　　状态: Received　　发布时间: 2026-07-20

漏洞描述

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server.

🔍 技术细节

字段 值
CVE ID CVE-2026-13380
CVSS 评分 9.0 🔴
严重程度 严重
CVSS 向量 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE 分类 CWE-201,CWE-312
发布时间 2026-07-20
最后更新 2026-07-20
状态 Received
数据来源 57dba5dd-1a03-47f6-8b36-e84e47d335d8

🔗 参考链接