CVE-2007-6330 Meridian Prolog Manager 2007, and 7.5 and earlier, sends all usernames and passwords to the client in a (1) cleartext or (2) weakly encrypted format to support client-side login authentication, which....
HighCVSS 10.0
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Meridian Prolog Manager 2007, and 7.5 and earlier, sends all usernames and passwords to the client in a (1) cleartext or (2) weakly encrypted format to support client-side login authentication, which makes it easier for remote attackers to obtain database access by capturing credentials via a man-in-the-middle attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| meridian software prolog manager | = 7.0 | No fix listed |
| meridian software prolog manager | = 7.5 | No fix listed |
| meridian software prolog manager | = 2007 | No fix listed |
References
- 42634 vdb-entry
- 28065 third-party-advisory
- VU#120593 third-party-advisory us-government-resource
- www.kb.cert.org
- 20071211 Meridian Prolog Manager Username and Plain Text Password Disclosure mailing-list
- 26826 vdb-entry
- prologmanager-password-disclosure(38996) vdb-entry