CVEvulnerability

CVE-2007-4961

7.5 HIGH Published 2007-09-18 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-09-18
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-311

Description

The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.

Affected configurations

• lindenlab second life

Related

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

Referenced by CWE · observed example (3)

  • CWE-294 Authentication Bypass by Capture-replay weakness
  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References