CVEvulnerability

CVE-2007-5626

5.5 MEDIUM Published 2007-10-23 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2007-10-23
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-319

Description

make_catalog_backup in Bacula 2.2.5, and probably earlier, sends a MySQL password as a command line argument, and sometimes transmits cleartext e-mail containing this command line, which allows context-dependent attackers to obtain the password by listing the process and its arguments, or by sniffing the network.

Affected configurations

• bacula bacula (<= 2.2.5)

Related

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

Referenced by CWE · observed example (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References