PT-2007-1638 · Ajlogin · Ajlogin

Published 2007-01-09 · Updated 2018-10-16 · CVE-2007-0153

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions AJLogin version 3.5

Description The issue allows remote attackers to download a database containing passwords via a direct request for ajlogin.mdb due to insufficient access control. This is because sensitive information is stored under the web root.

Recommendations For AJLogin version 3.5, consider restricting access to the ajlogin.mdb file to minimize the risk of exploitation. As a temporary workaround, limit direct requests to this file until a more secure storage solution is implemented.

Fix

Related Identifiers

CVE-2007-0153

Affected Products

Ajlogin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-0153 · Security Note
• http://osvdb.org/33404 · Note
• http://securityreason.com/securityalert/2127 · Note
• http://securityfocus.com/archive/1/456226/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31331 · Note