CVE-2009-2945 Information disclosure in n/a
Stanford WebAuth login script exposes passwords in URLs, allowing attackers to steal credentials via logs or browser history.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2009-2945?
CVE-2009-2945 is a medium-severity vulnerability in n/a, published on 15 Sep 2009. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Weakness: CWE-255
Which versions are affected by CVE-2009-2945?
It affects 1 product.
Products include Stanford Webauth.
How do I fix CVE-2009-2945?
Upgrade to a fixed version.
Is CVE-2009-2945 being exploited?
There is no known exploitation of CVE-2009-2945 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2009-2945, GHSA-c2mw-mjjw-7p85.