Coffeecup · Coffeecup Password Wizard · CVE-2003-1394
**Name of the Vulnerable Software and Affected Versions**
CoffeeCup Software Password Wizard version 4.0
**Description**
The issue concerns the storage of sensitive information, such as usernames and passwords, in a .apw file. This file is located under the web document root with insufficient access control, allowing remote attackers to obtain the information by making a direct request for the file.
**Recommendations**
For CoffeeCup Software Password Wizard version 4.0, restrict access to the .apw file to prevent remote attackers from obtaining sensitive information. Consider relocating the file outside of the web document root or implementing proper access controls to mitigate the risk.