PT-2008-5464 · Kolab · Kolab Groupware Server

Published 2008-09-22 · Updated 2017-08-08 · CVE-2008-4165

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kolab Groupware Server version 1.0.0

Description The issue allows local administrators, and possibly remote attackers, to obtain cleartext passwords. This is because the admin/user/create user.php file in the affected software places a user password in an HTTP GET request. Attackers can read the ssl access log file or the referer string to obtain the passwords.

Recommendations For Kolab Groupware Server version 1.0.0, consider restricting access to the ssl access log file and avoiding the use of HTTP GET requests for sensitive information, such as user passwords, until a proper fix is available. As a temporary workaround, consider disabling the create user.php function to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2008-4165

Affected Products

Kolab Groupware Server

References · 6

• http://securityfocus.com/bid/31165 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-4165 · Security Note
• http://mandriva.com/en/security/advisories?name=MDVSA-2008:193 · Vendor Advisory
• https://qa.mandriva.com/show_bug.cgi?id=43434 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45124 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4165 · Note