CVEvulnerability
CVE-2004-0779
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2004-08-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The (1) Mozilla 1.6, (2) Firebird 0.7 and (3) Firefox 0.8 web browsers do not properly verify that cached passwords for SSL encrypted sites are only sent via SSL encrypted sessions to the site, which allows a remote attacker to cause a cached password to be sent in cleartext to a spoofed site.
Affected configurations
• firebirdsql firebird 0.7
• mozilla firefox 0.8
• mozilla mozilla 1.6
References
- http://bugzilla.mozilla.org/show_bug.cgi?id=226278 bugzilla.mozilla.org
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:082 www.mandriva.com
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7 www.mozilla.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17018 exchange.xforce.ibmcloud.com
- http://bugzilla.mozilla.org/show_bug.cgi?id=226278 bugzilla.mozilla.org
- http://www.mandriva.com/security/advisories?name=MDKSA-2004:082 www.mandriva.com
- http://www.mozilla.org/projects/security/known-vulnerabilities.html#mozilla1.7 www.mozilla.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/17018 exchange.xforce.ibmcloud.com