Kayako Fusion Database Report Generation Information Disclosure Vulnerability

Bugtraq ID:	50894
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2011 12:00AM
Updated:	Dec 02 2011 12:00AM
Credit:	Yuri Goltsev and Alexander Zaitsev of Positive Research Center
Vulnerable:	Kayako Fusion 0
Not Vulnerable:

Kayako Fusion Database Report Generation Information Disclosure Vulnerability

Kayako Fusion is prone to an information-disclosure vulnerability.

Successful exploits of this issue may allow an attacker to obtain sensitive information, such as username and password hashes.

Kayako Fusion Database Report Generation Information Disclosure Vulnerability

Attackers can exploit the issue by using readily available utilities.

Kayako Fusion Database Report Generation Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for details.

Kayako Fusion Database Report Generation Information Disclosure Vulnerability

References:

• Kayako Homepage (Kayako)
  
• [[email protected]: [PT-2011-43] Database information disclosure in Kayako F ([email protected])