CVE-2002-1656 X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.txt data file, and providing it in a cooki...
HighCVSS 7.5
EPSS 8.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
X-News (x_news) 1.1 and earlier allows attackers to authenticate as other users by obtaining the MD5 checksum of the password, e.g. via sniffing or the users.txt data file, and providing it in a cookie.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xqus x-news | = 1.0 | No fix listed |
| xqus x-news | = 1.1 | No fix listed |
References
- 1003828 exploit vdb-entry
- www.ifrance.com
- VU#162723 third-party-advisory us-government-resource
- 4283 vdb-entry
- xnews-users-world-readable(8465) vdb-entry