CVE-2011-1509 in ServiceDesk Plus

Riassunto

di MITRE

The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Prenotare: 23/03/2011
• Divulgazione: 20/09/2011
• Moderazione: accettato
• Voce: VDB-58567
• CPE: pronto
• CWE: CWE-310 (confermato)
• CVSS: 5.3 (VulDB)
• EPSS: 0.00787
• KEV: no
• Attività: molto basso

Fonti

• MITRE: https://www.cve.org/CVERecord?id=CVE-2011-1509
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2011-1509
• CVE Details: https://www.cvedetails.com/cve/CVE-2011-1509/