PT-2005-3367 · Kayako · Kayako Liveresponse

James Bercegay · Published 2005-12-31 · Updated 2016-10-18 · CVE-2005-2462

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kayako liveResponse versions 2.x

Description The issue allows local users and possibly remote attackers to gain privileges by exploiting the fact that passwords are recorded in plaintext in the URL when a user logs in.

Recommendations For Kayako liveResponse versions 2.x, consider disabling the login functionality until a fix is available to prevent passwords from being recorded in plaintext. Restrict access to the login module to minimize the risk of exploitation. Avoid using the password parameter in the affected login endpoint until the issue is resolved.

Fix

Related Identifiers

CVE-2005-2462

Affected Products

Kayako Liveresponse

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-2462 · Security Note
• http://secunia.com/advisories/16286 · Vendor Advisory
• http://osvdb.org/18398 · Note
• http://marc.info/?l=bugtraq&m=112274359718863&w=2 · Note
• http://gulftech.org/?node=research&article_id=00092-07302005 · Note
• http://securityfocus.com/bid/14425 · Note