Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2009-2945

HistoryOct 03, 2022 - 4:24 p.m.

CVE-2009-2945

2022-10-0316:24:06

Debian Security Bug Tracker

security-tracker.debian.org

cve-2009-2945

weblogin

password exposure

stanford university

unix

post to get.

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

54.1%

JSON

weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

OSVersionArchitecturePackageVersionFilename
Debian11allwebauth< 3.6.2-1webauth_3.6.2-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	webauth	< 3.6.2-1	webauth_3.6.2-1_all.deb

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

54.1%

JSON

Related for DEBIANCVE:CVE-2009-2945