CVEvulnerability
CVE-2008-0407
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-01-29
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-287
Description
HTTP File Server (HFS) before 2.2c tags HTTP request log entries with the username sent during HTTP Basic Authentication, regardless of whether authentication succeeded, which might make it more difficult for an administrator to determine who made a remote request.
Affected configurations
• hfs http file server (<= 2.2b)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://secunia.com/advisories/28631 Vendor Advisory
- http://securityreason.com/securityalert/3582 securityreason.com
- http://www.rejetto.com/hfs/?f=wn www.rejetto.com
- http://www.securityfocus.com/archive/1/486874/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27423 www.securityfocus.com
- http://www.syhunt.com/advisories/hfs-1-username.txt www.syhunt.com
- http://www.syhunt.com/advisories/hfshack.txt Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39877 exchange.xforce.ibmcloud.com
- http://secunia.com/advisories/28631 Vendor Advisory
- http://securityreason.com/securityalert/3582 securityreason.com
- http://www.rejetto.com/hfs/?f=wn www.rejetto.com
- http://www.securityfocus.com/archive/1/486874/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/27423 www.securityfocus.com
- http://www.syhunt.com/advisories/hfs-1-username.txt www.syhunt.com
- http://www.syhunt.com/advisories/hfshack.txt Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39877 exchange.xforce.ibmcloud.com