PT-2008-5464 · Kolab · Kolab Groupware Server

Publicado 2008-09-22 · Atualizado 2017-08-08 · CVE-2008-4165

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kolab Groupware Server version 1.0.0

Description The issue allows local administrators, and possibly remote attackers, to obtain cleartext passwords. This is because the admin/user/create user.php file in the affected software places a user password in an HTTP GET request. Attackers can read the ssl access log file or the referer string to obtain the passwords.

Recommendations For Kolab Groupware Server version 1.0.0, consider restricting access to the ssl access log file and avoiding the use of HTTP GET requests for sensitive information, such as user passwords, until a proper fix is available. As a temporary workaround, consider disabling the create user.php function to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2008-4165

Produtos afetados

Kolab Groupware Server

Referências · 6

• https://qa.mandriva.com/show_bug.cgi?id=43434 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45124 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4165 · Nota
• http://securityfocus.com/bid/31165 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-4165 · Nota de Segurança
• http://mandriva.com/en/security/advisories?name=MDVSA-2008:193 · Aviso do Fabricante