PT-2007-2856 · Conga · Conga

Published 2007-03-15 · Updated 2023-02-13 · CVE-2007-1462

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions conga (affected versions not specified)

Description The issue concerns the luci server component in conga, where the password is preserved between page loads for the Add System/Cluster task flow. This is done by storing the password in the Value attribute of a password entry field. As a result, attackers may be able to steal the password by performing actions like viewing the source of the web page or other similar operations. It's noted that the feasibility of such an attack is limited to specific circumstances.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1462

Affected Products

Conga

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2007-1462 · Security Note
• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228637 · Vendor Advisory
• http://osvdb.org/35086 · Note