CVEvulnerability
CVE-2007-3420
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-06-26
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
The Random Cookie Password functionality in the loaduser function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 does not clear the (1) username, (2) password, (3) usertheme, and (4) userlang cookies for unauthorized users, which has unknown impact and remote attack vectors.
Affected configurations
• web-app.org webapp (<= 0.9.9.6)
References
- http://osvdb.org/45401 osvdb.org
- http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 www.web-app.org
- http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip Patch
- http://osvdb.org/45401 osvdb.org
- http://www.web-app.org/cgi-bin/index.cgi?action=forum&board=how_to&op=display&num=9458 www.web-app.org
- http://www.web-app.org/downloads/WebAPPv0.9.9.7.zip Patch