CVE-2010-3845 libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log.
CriticalCVSS 9.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libapache-authenhook-perl(Debian:12) | < 2.00-04+pristine-2 | 2.00-04+pristine-2 |
| debian/libapache-authenhook-perl(Debian:13) | < 2.00-04+pristine-2 | 2.00-04+pristine-2 |
| debian/libapache-authenhook-perl(Debian:14) | < 2.00-04+pristine-2 | 2.00-04+pristine-2 |
| apache authenhook project apache authenhook | = 2.00-04 | No fix listed |
References
- Debian Security Tracker CVE-2010-3845 vendor-advisory
- [oss-security] 20101013 Re: CVE request: Apache-AuthenHook perl module mailing-list third-party-advisory
- bugs.debian.org patch third-party-advisory
- rt.cpan.org patch third-party-advisory
- bugs.debian.org issue-tracking