CVE-2004-2443 Auth bypass in n/a
Remote attackers can bypass authentication in Jaws by sending a specific cookie, gaining unauthorized admin access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2004-2443?
CVE-2004-2443 is a high-severity authentication bypass vulnerability in n/a, published on 20 Aug 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jaws 0.3 allows remote attackers to bypass authentication and via an HTTP request to admin.php with the logged cookie set to the MD5 hash of a null password, which is compared against the logged session variable by the logged_on function in application.php.
Which versions are affected by CVE-2004-2443?
It affects 1 product.
Products include Jaws Jaws.
How do I fix CVE-2004-2443?
No fix has been published for CVE-2004-2443 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2004-2443 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2004-2443 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-wj6r-f23g-8gv8.