CVEvulnerability

CVE-2005-3429

4.3 MEDIUM Published 2005-11-02 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2005-11-02
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 2.0 ([email protected]): 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N

Description

Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.

Affected configurations

• rockliffe mailsite express (<= 6.1.21) • rockliffe mailsite express 6.1.20

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html Exploit, Patch
http://marc.info/?l=bugtraq&m=113053680631151&w=2 marc.info
http://securitytracker.com/id?1015117 securitytracker.com
http://www.osvdb.org/22682 www.osvdb.org
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/22906 exchange.xforce.ibmcloud.com
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html Exploit, Patch
http://marc.info/?l=bugtraq&m=113053680631151&w=2 marc.info
http://securitytracker.com/id?1015117 securitytracker.com
http://www.osvdb.org/22682 www.osvdb.org
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf Exploit, Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/22906 exchange.xforce.ibmcloud.com