WorkforceROI Xpede Re-Authentication Plain Text Password Disclosure Vulnerability

Bugtraq ID:	4346
Class:	Design Error
CVE:	CVE-2002-0487
Remote:	No
Local:	Yes
Published:	Mar 22 2002 12:00AM
Updated:	Jul 11 2009 11:56AM
Credit:	Reported by Gregory Duchemin <[email protected]>.
Vulnerable:	WorkforceROI Xpede 7.0 WorkforceROI Xpede 4.1
Not Vulnerable:

WorkforceROI Xpede Re-Authentication Plain Text Password Disclosure Vulnerability

An issue has been reported in Xpede which could allow a user to reveal the plain text password of users.

When attempting re-authentication for a timed out session, Xpede uses Javascript to verify whether a user has enabled the 'Remember my password' option. Viewing the source of this Javascript will reveal the user's password in plain text.

WorkforceROI Xpede Re-Authentication Plain Text Password Disclosure Vulnerability

No exploit code required.

WorkforceROI Xpede Re-Authentication Plain Text Password Disclosure Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

WorkforceROI Xpede Re-Authentication Plain Text Password Disclosure Vulnerability

References:

• WorkforceROI Homepage (WorkforceROI)