PT-2001-2622 · Twig · Twig Webmail

CVE-2001-1537 · Publicado 2001-12-31 · Atualizado 2024-02-13

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TWIG webmail versions 2.7.4 and earlier

Description The default "basic" security setting in config.php for TWIG webmail stores cleartext usernames and passwords in cookies. This could allow attackers to obtain authentication information and gain privileges.

Recommendations For TWIG webmail versions 2.7.4 and earlier, consider changing the security setting from "basic" to a more secure option to prevent cleartext usernames and passwords from being stored in cookies. As a temporary workaround, restrict access to sensitive areas of the webmail application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2001-1537

Produtos afetados

Twig Webmail

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-1537 · Nota de Segurança
• http://archives.neohapsis.com/archives/bugtraq/2001-11/0245.html · Nota
• http://securityfocus.com/bid/3591 · Nota
• http://iss.net/security_center/static/7619.php · Nota
• https://t.me/cvenotify/71239 · Publicação no Telegram