Datalex Bookit! Consumer Plaintext Authentication Credentials Vulnerability
BID:4972
Info
Datalex Bookit! Consumer Plaintext Authentication Credentials Vulnerability
| Bugtraq ID: | 4972 |
| Class: | Design Error |
| CVE: |
CVE-2002-0933 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Discovery of this issue is credited to Michael Sutton <[email protected]>. |
| Vulnerable: |
Datalex Bookit! Consumer 2.0 |
| Not Vulnerable: |
Datalex Bookit! Consumer 2.4 Datalex Bookit! Consumer 2.3 Datalex Bookit! Consumer 2.2 |
Discussion
Datalex Bookit! Consumer Plaintext Authentication Credentials Vulnerability
Datalex Bookit! Consumer cookies contain plaintext authentication credentials. Additionally, due to use of the CGI GET method, plaintext authentication credentials are sent in CGI parameters. This becomes an issue if the authentication credentials ever become exposed to an attacker.
Datalex Bookit! Consumer cookies contain plaintext authentication credentials. Additionally, due to use of the CGI GET method, plaintext authentication credentials are sent in CGI parameters. This becomes an issue if the authentication credentials ever become exposed to an attacker.
Solution / Fix
Datalex Bookit! Consumer Plaintext Authentication Credentials Vulnerability
Solution:
This issue has been addressed in versions 2.2 and later.
Solution:
This issue has been addressed in versions 2.2 and later.