PT-2002-1538 · Intellisol · Intellisol Xpede

Published 2002-06-11 · Updated 2008-09-05 · CVE-2002-0487

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Intellisol Xpede version 4.1

Description The issue allows local users with access to gain privileges of other Xpede users by reading passwords stored in plaintext. This is due to a "session timeout" re-authentication capability in the Javascript code.

Recommendations For Intellisol Xpede version 4.1, consider disabling the re-authentication capability until a patch is available to prevent local users from accessing plaintext passwords. Restrict access to the source file and clear browser caches to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-0487

Affected Products

Intellisol Xpede

References · 4

• 🔥 http://securityfocus.com/bid/4346 · Exploit
• http://securityfocus.com/archive/1/263485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0487 · Security Note
• http://iss.net/security_center/static/8612.php · Vendor Advisory