PT-2001-2622 · Twig · Twig Webmail

Published 2001-12-31 · Updated 2024-02-13 · CVE-2001-1537

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TWIG webmail versions 2.7.4 and earlier

Description The default "basic" security setting in config.php for TWIG webmail stores cleartext usernames and passwords in cookies. This could allow attackers to obtain authentication information and gain privileges.

Recommendations For TWIG webmail versions 2.7.4 and earlier, consider changing the security setting from "basic" to a more secure option to prevent cleartext usernames and passwords from being stored in cookies. As a temporary workaround, restrict access to sensitive areas of the webmail application to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2001-1537

Affected Products

Twig Webmail

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-1537 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2001-11/0245.html · Note
• http://securityfocus.com/bid/3591 · Note
• http://iss.net/security_center/static/7619.php · Note
• https://t.me/cvenotify/71239 · Telegram Post