1. CVE-Search
  2. CVE-2011-1509
ID CVE-2011-1509
Summary The encryptPassword function in Login.js in ManageEngine ServiceDesk Plus (SDP) 8012 and earlier uses a Caesar cipher for encryption of passwords in cookies, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
References
Vulnerable Configurations
  • cpe:2.3:a:manageengine:servicedesk_plus:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:manageengine:servicedesk_plus:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:manageengine:servicedesk_plus:*:*:*:*:*:*:*:*
    cpe:2.3:a:manageengine:servicedesk_plus:*:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 09-10-2018 - 19:31)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
bid 49636
bugtraq 20110914 CORE-2011-0506 - Multiples Vulnerabilities in ManageEngine ServiceDesk Plus
misc http://www.coresecurity.com/content/multiples-vulnerabilities-manageengine-sdp
sreason 8385
xf servicedesk-loginjs-security-bypass(69841)
Last major update 09-10-2018 - 19:31
Published 20-09-2011 - 10:55
Last modified 09-10-2018 - 19:31
Back to Top