EUVD-2026-102422Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to BRPerfX admin interface
-
ExploitOpen admin config page and view client-side source
-
ExecutionExtract plaintext LDAP bind credentials
-
ImpactReuse credentials against LDAP directory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V6 - Authentication Credential protection in transit/storage
|
| Exploitation Conditions | Requires an authenticated session with administrator privileges on the BRPerfX 1.4.4.0 administrative configuration interface; the attacker then simply inspects the delivered client-side code (view-source / browser developer tools) to read the LDAP bind credentials stored in plaintext. Key limiting factors: (1) administrative authentication is mandatory - this is not reachable by an unauthenticated remote attacker despite the NVD PR:N label; (2) impact is amplified only if the exposed LDAP account is reused and privileged within the broader directory. No user interaction by a victim and no non-default configuration are needed - the exposure is inherent to the affected version's admin interface. |
| Impact | Signals point to a modest, lower-priority risk despite the 7.5 (High) CVSS. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/C:H) would imply unauthenticated network retrieval of high-value data, but the description explicitly states that only an AUTHENTICATED ADMINISTRATOR can inspect the client-side code to recover the LDAP credentials - this directly contradicts PR:N. The vector appears to overstate severity; a realistic rating is PR:H, which lowers the true base score. EPSS is low (0.31%, 22nd percentile) and SSVC records Exploitation: none, meaning no observed exploitation; there is no CISA KEV listing and no confirmed public exploit code (the GitHub 'Public-Reference-Pack' reference is documentation, not a verified weaponized PoC). SSVC does mark Automatable: yes with partial technical impact, but automation is largely moot when a privileged admin session is already required. The dominant limiting factor is that exploitation presupposes administrative access, so the flaw is better characterized as a credential-hygiene / privilege-escalation-enabler (exposure of reusable LDAP directory credentials) than a directly remotely exploitable disclosure. Net: real but low-urgency for most environments; prioritize only where BRPerfX is deployed and the exposed LDAP account is privileged against the wider directory. |
| Exploit ScenarioDerived | An authenticated BRPerfX administrator (or an attacker who has already compromised an admin session) opens the administrative configuration interface and views the page source / browser developer tools, where the LDAP bind credentials are embedded in plaintext client-side code. The attacker copies the directory username and password and reuses them to authenticate directly against the organization's LDAP/Active Directory, pivoting beyond the application. No public exploit code is confirmed, and no special tooling is needed beyond a browser. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Plaintext LDAP bind credentials are exposed in the administrative configuration interface of Trisolutions BRPerfX 1.4.4.0, allowing an attacker holding an authenticated administrator session to recover the directory credentials simply by viewing the delivered client-side code (view-source or browser developer tools). The exposure is inherent to the affected version - no victim interaction and no non-default configuration are required - but administrative authentication is a hard prerequisite, so the practical risk is lower than the 7.5 (High) base score suggests; EPSS is 0.31% (22nd percentile), SSVC records Exploitation: none, and no public exploit has been identified at time of analysis. The real impact depends on what the exposed LDAP account can reach: if it is a reused or privileged directory account, credential reuse pivots the finding from information disclosure into potential broader directory compromise.
RemediationAI
No vendor-released patch has been identified at time of analysis, and the references supplied (vendor site, the UFRGS GIMSCop product page, and the public reference pack) do not point to a fixed version or vendor advisory with a remediation, so the primary action is not an upgrade but containment. First, restrict reachability of the BRPerfX administrative configuration interface to a trusted management network or VPN and block it at the perimeter; the trade-off is that administrators lose direct remote access and must route through the VPN or an internal jump host, but this removes the population of sessions that could read the embedded credential. Second, rotate the LDAP bind credential immediately and replace it with a dedicated, least-privilege, read-only service account scoped to only the directory objects BRPerfX needs - the trade-off is possible breakage of features that rely on broader directory reads, which should be validated in a test instance first. Third, audit directory logs for anomalous binds using the previously embedded account to detect any harvesting that already occurred, and avoid reusing that credential anywhere else in the environment, since reuse converts this disclosure into lateral movement. Finally, monitor the vendor site and the reference pack for a patched release, and when one ships, verify that credentials are no longer delivered to the browser before re-exposing the interface beyond the trusted network.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-522, Insufficiently Protected Credentials: a secret required for authentication to a backend service is stored or transmitted without adequate protection. Here the secret is the LDAP bind credential used by BRPerfX, and it is embedded in client-side code served to the browser rather than held server-side. Because the browser must receive the credential to render the administrative configuration interface, any session that can load that interface can read the secret; the protection boundary is therefore the admin login itself rather than any cryptographic control. The technology chain involved is a web-delivered administrative console talking to an LDAP directory (the standard protocol used by BRPerfX-related deployments at UFRGS GIMSCop/BR-PGA for identity and performance-data workflows). NVD's published vector labels this PR:N, but the independent assessment corrects that to PR:H - the credential is only reachable behind the administrative login - and the downstream risk hinges on the privileges and reuse of the exposed LDAP account rather than on any memory-safety, injection, or code-execution primitive. No CPE strings were supplied by the sources, and EUVD lists the affected version as n/a, so version scoping rests on the vendor's own product documentation for BRPerfX 1.4.4.0.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description requires an authenticated administrator to view client-side code, so PR:H (not PR:N); network-reachable web interface AV:N, AC:L, high confidentiality loss of LDAP credentials, no integrity/availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface. An authenticated administrator can inspect the client-side code to retrieve the credential.
Executive ViewAI
Trisolutions BRPerfX 1.4.4.0 delivers the credentials its administration console uses to bind to the corporate directory in a form that can be read directly from the browser, so anyone who already holds an administrative session on the product can recover directory credentials silently, with no special configuration and no user interaction. The real business exposure is second-order: if that directory account is privileged or reused across systems, a straightforward information leak becomes a pivot toward broader directory compromise, and no vendor fix is currently available. Security leadership should care because the risk is entirely dependent on how much access the exposed directory account has been granted.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative interface access to trusted networks and jump hosts; enforce multi-factor authentication for all administrative sessions; rotate the exposed LDAP bind credentials and eliminate password reuse; replace the bind account with a dedicated least-privilege directory service account; monitor directory and application logs for anomalous binds tied to BRPerfX hosts; limit who can reach the console and review access periodically until a vendor fix is issued.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB