PT-2004-3469 · Phpgroupware · Phpgroupware

Skwashd · Published 2004-12-31 · Updated 2017-07-11 · CVE-2004-2578

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions phpGroupWare versions prior to 0.9.16.002

Description The issue concerns the transmission of sensitive information in plaintext. Specifically, the header admin and setup passwords are sent via cookies without encryption, allowing remote attackers to intercept these passwords through sniffing.

Recommendations For versions prior to 0.9.16.002, update to version 0.9.16.002 or later to resolve the issue. As a temporary workaround, consider restricting access to the application to minimize the risk of password interception. Avoid using the application over unsecured networks until the update is applied.

Fix

Related Identifiers

CVE-2004-2578

Affected Products

Phpgroupware

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-2578 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/16970 · Note
• http://web.archive.org/web/20040920024328/http://phpgroupware.org · Note
• http://osvdb.org/8354 · Note
• http://securityfocus.com/bid/10895 · Note