CVE-2005-3429 Information disclosure in n/a
Attackers can steal plaintext passwords from cookies via XSS or local access if login saving is enabled, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2005-3429?
CVE-2005-3429 is a medium-severity vulnerability in n/a, published on 2 Nov 2005. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.
Which versions are affected by CVE-2005-3429?
It affects 1 product.
Products include Rockliffe Mailsite Express.
How do I fix CVE-2005-3429?
No fix has been published for CVE-2005-3429 yet. Limit exposure of the affected software until one is available.
Is CVE-2005-3429 being exploited?
There is no known exploitation of CVE-2005-3429 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8ggf-rh55-625w.