CVE-2001-1537 Information disclosure in n/a
Default settings store cleartext credentials in cookies, allowing attackers to steal authentication information and gain unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2001-1537?
CVE-2001-1537 is a high-severity vulnerability in n/a, published on 14 Jul 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.
Weakness: CWE-312
Which versions are affected by CVE-2001-1537?
It affects 1 product.
Products include Symfony Twig.
How do I fix CVE-2001-1537?
No fix has been published for CVE-2001-1537 yet. Limit exposure of the affected software until one is available.
Is CVE-2001-1537 being exploited?
There is no known exploitation of CVE-2001-1537 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-13818 Code injection in n/a
- CVE-2026-46633 Twig: PHP code injection via `{% use %}` template name
- CVE-2026-46640 Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation
- CVE-2026-24425 Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
- CVE-2024-45411 Twig has a possible sandbox bypass
Sources
Also known as GHSA-f465-339w-2vhm.