CVEvulnerability
CVE-2014-3445
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-01-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-522
Description
backup.php in HandsomeWeb SOS Webpages before 1.1.12 does not require knowledge of the cleartext password, which allows remote attackers to bypass authentication by leveraging knowledge of the administrator password hash.
Affected configurations
• handsomeweb sos webpages (< 1.1.12)
Related
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- http://packetstormsecurity.com/files/126844/HandsomeWeb-SOS-Webpages-1.1.11-Backup-Hash-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/May/130 Exploit, Mailing List, Third Party Advisory
- http://sourceforge.net/projects/soswebpages/files/SOS%20Webpages/SOS%20Webpages%201.1.12/ Third Party Advisory
- http://www.securityfocus.com/bid/67644 Third Party Advisory, VDB Entry
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/ Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/126844/HandsomeWeb-SOS-Webpages-1.1.11-Backup-Hash-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/May/130 Exploit, Mailing List, Third Party Advisory
- http://sourceforge.net/projects/soswebpages/files/SOS%20Webpages/SOS%20Webpages%201.1.12/ Third Party Advisory
- http://www.securityfocus.com/bid/67644 Third Party Advisory, VDB Entry
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/ Exploit, Third Party Advisory