CVE-2018-9160 in the critical feed json
SiCKRAGE Discloses Plaintext Credentials
published 2018-03-31 8 y ago modified 2026-06-17 4 mo ago also GHSA-jrcv-3c5h-rh3q , PYSEC-2018-101 , EUVD-2018-0136
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 76.0%
- EPSS 76.0% chance of exploitation in 30 days, percentile 99.5%
- public exploits
- 2
- Metasploit, Exploit-DB
Summary
SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
Patch / fix
Timeline
- First public exploit (Metasploit auxiliary/scanner/http/http_sickrage_password_leak)
- Published
Exploit prediction
75.98% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/scanner/http/http_sickrage_password_leak HTTP SickRage Password Leak metasploit auxiliary, normal rank, 2018-03-08
- EDB-44545 SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response webapps, 2018-04-26
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | sickrage | <2018.03.09-1 <9.3.2 |
2018.03.09-1 9.3.2 |
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/SickRage/SickRage/commit/8156a74a68aea930d1e1047baba8b115c3abfc44
web, patch, third-party-advisory
-
exploit-db.com
/exploits/44545/
exploit, third-party-advisory, vdb-entry, web
-
github.com
/SickRage/sickrage.github.io/blob/master/sickrage-news/CHANGES.md
broken-link, third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2018-9160
advisory
-
github.com
/SickRage/SickRage
package
-
github.com
/pypa/advisory-database/tree/main/vulns/sickrage/PYSEC-2018-101.yaml
web
-
exploit-db.com
/exploits/44545
web
-
github.com
/advisories/GHSA-jrcv-3c5h-rh3q
advisory
Sources
- CVE List CVE-2018-9160
- GitHub Advisory GHSA-jrcv-3c5h-rh3q
- NVD CVE-2018-9160
- OSV PYSEC-2018-101
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.