PT-2002-2371 · Slash · Slashcode

Publicado 2002-12-31 · Atualizado 2016-10-18 · CVE-2002-1647

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Slash Slashcode (affected versions not specified)

Description The issue concerns the quick login feature, which fails to redirect the user to an alternate URL when an incorrect password is entered. This allows remote websites to potentially guess passwords by reading the username and password from the Referrer URL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2002-1647

Produtos afetados

Slashcode

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2002-1647 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=103238514720237&w=2 · Nota
• http://marc.info/?l=bugtraq&m=103176636403241&w=2 · Nota
• http://marc.info/?l=bugtraq&m=103177860017930&w=2 · Nota
• http://kb.cert.org/vuls/id/603945 · Nota