EUVD-2026-38283
GHSA-xfpj-q55p-7h2m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Reading cleartext secrets from process memory realistically needs local, low-privileged host access (AV:L, PR:L); impact is confidentiality-only (C:H, I:N, A:N) with no scope change.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allows an attacker to retrieve user passwords and cryptographic keys from memory. Attacker can use the same keys to decrypt password, gain access to the application and access sensitive data in the database.
AnalysisAI
Sensitive-data disclosure in IBM Datacap and Datacap Navigator (versions 9.1.7, 9.1.8, 9.1.9) lets an attacker recover user passwords and cryptographic keys that the application holds in cleartext in memory; the recovered keys can then decrypt stored credentials, authenticate to the application, and reach sensitive data in the backing database. IBM has released a patch. There is no public exploit identified at time of analysis, EPSS exploitation probability is negligible (0.08%, 0th percentile), and CISA SSVC rates exploitation as 'none' - indicating low immediate field risk despite the high CVSS confidentiality impact.
Technical ContextAI
IBM Datacap is an enterprise document/data-capture platform and Datacap Navigator is its web client. The root cause maps to CWE-316 (Cleartext Storage of Sensitive Information in Memory): the process retains passwords and the cryptographic key material used to protect them in an unprotected, recoverable form within process memory rather than zeroizing or encrypting it. Because the same key that protects stored passwords is exposed, an attacker who reads that memory can reverse the protection scheme, decrypt credential stores, and laterally access the application database. Affected packages per CPE are cpe:2.3:a:ibm:datacap and cpe:2.3:a:ibm:datacap_navigator (all version fields wildcard in NVD CPE, with EUVD constraining to the 9.1.7-9.1.9 lines).
RemediationAI
Apply the IBM-released fix per the vendor advisory at https://www.ibm.com/support/pages/node/7276609 (Patch available per vendor advisory; the advisory enumerates the fixed fix-pack levels above the vulnerable 9.1.7 ≤1.8.4 and Navigator 9.1.7 ≤8.2.1.0 builds - confirm the exact target build from that page rather than an assumed version number). Until the patch is deployed, reduce exposure of the credential/key material: restrict and monitor administrative and local access to the Datacap application servers so process memory cannot be read by unprivileged users, segment the Datacap and Navigator hosts away from general user networks, and rotate any application passwords and cryptographic keys after patching since pre-patch keys may already be compromised. Note the trade-off that host-access restrictions and network segmentation limit operator convenience and remote administration but do not themselves remove the in-memory exposure - only the vendor patch does that.
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper v
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that coul
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that cou
Cross-site scripting in IBM Datacap and Datacap Navigator 9.1.7 through 9.1.9 allows unauthenticated remote attackers to
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be rea
IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By pe
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. Rated medium severity
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. Rated medium s
Forced browsing exposure in IBM Datacap and IBM Datacap Navigator 9.1.7 through 9.1.9 allows a highly privileged local u
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to traverse directories on the
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 displays version information in HTTP requests that could all
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today