CVE-2001-1481 Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows remote attackers to gain privileges.
CriticalCVSS 9.8
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Xitami 2.4 through 2.5 b4 stores the Administrator password in plaintext in the default.aut file, whose default permissions are world-readable, which allows remote attackers to gain privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xitami | >= 2.4, <= 2.5 | No fix listed |
| xitami | = 2.5-beta4 | No fix listed |
References
- archives.neohapsis.com broken-link exploit vendor-advisory
- 20011126 Xitami Webserver stores admin password in clear text. broken-link mailing-list third-party-advisory vdb-entry
- 3582 broken-link third-party-advisory vdb-entry
- xitami-default-password-plaintext(7600) third-party-advisory vdb-entry