vulnwire
4.6med

CVE-2002-0487

Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
4.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 38%
Public exploits
0
none known

Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local users with access to gain privileges of other Xpede users by reading the password from the source file, e.g. from the browser's cache.

Exploit prediction (EPSS)

0.44% probability of exploitation in the next 30 days, higher than 38% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

References

  • securityfocus.com /archive/1/263485 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • iss.net /security_center/static/8612.php · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/4346 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.