VulnerabilityModified
CVE-2004-2578
phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords.
MEDIUM 5.0EPSS 1.43%
Does this matter?
Lower severity and a low EPSS score (1.43%). Track it; it rarely justifies an emergency change on its own.
Description
phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cookies, which allows remote attackers to sniff passwords.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
- EPSS
- 1.43% probability · 71th percentile
- CISA KEV
- Not listed
- Affected
- phpgroupware/phpgroupware
- Source
- cve@mitre.org
References
- http://web.archive.org/web/20040920024328/http://www.phpgroupware.org/
- http://www.osvdb.org/8354
- http://www.securityfocus.com/bid/10895
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16970
- http://web.archive.org/web/20040920024328/http://www.phpgroupware.org/
- http://www.osvdb.org/8354
- http://www.securityfocus.com/bid/10895
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16970
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.