CVE-2020-9425

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in...

PT-2020-20649

Name of the Vulnerable Software and Affected Versions rConfig versions prior to 3.9.4 Description An issue in the includes/head.inc.php file allows an unauthenticated attacker to retrieve saved cleartext credentials via a GET request to the "settings.php" endpoint. This occurs because the...

CVE-2020-9425: Always-Incorrect Control Flow Implementation

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in...