CVE-2019-17355

CVE-2019-17355 describes a critical vulnerability in the Orbitz Android application version 19.31.1, where user credentials (username and password) are inadvertently logged during the authentication process. This flaw, categorized as CWE-532 (Inclusion of Sensitive Information in Log Files), allows attackers with access to device logs (via logcat) to potentially compromise user accounts. With a CVSS score of 9.8 (CRITICAL), the vulnerability is easily exploitable over the network with low attack complexity, posing a high risk of confidentiality, integrity, and availability compromise. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.