Melange Chat Session Header Information Disclosure Vulnerability

Bugtraq ID:	16747
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 21 2006 12:00AM
Updated:	Feb 22 2006 08:07PM
Credit:	Nexus <[email protected]> is credited with the discovery of this vulnerability.
Vulnerable:	Melange Melange Chat System 1.10
Not Vulnerable:

Melange Chat Session Header Information Disclosure Vulnerability


Melange Chat is prone to an information-disclosure vulnerability. This issue is due to a failure in the application to properly secure HTTP request data.

An attacker can exploit this issue to retrieve the credentials of an arbitrary user.

If an administrative user's credentials are retrieved, successful exploitation may result in the compromise of the affected application; other attacks are also possible.

Melange Chat Session Header Information Disclosure Vulnerability

An exploit is not required.

Melange Chat Session Header Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Melange Chat Session Header Information Disclosure Vulnerability

References:

• Melange Chat Homepage (Melange)
  
• grab cookie information with Melange Chat Server 1.10 (Nexus)