SecuritySpace - CVE-2009-3166

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2009-3166

Description: token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

Test IDs: 1.3.6.1.4.1.25623.1.0.801413 1.3.6.1.4.1.25623.1.0.64928

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2009-3166
BugTraq ID: 36372
http://www.securityfocus.com/bid/36372
http://www.securitytracker.com/id?1022902
http://secunia.com/advisories/36718

CVE ID:	CVE-2009-3166
Description:	token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.
Test IDs:	1.3.6.1.4.1.25623.1.0.801413 1.3.6.1.4.1.25623.1.0.64928
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3166 BugTraq ID: 36372 http://www.securityfocus.com/bid/36372 http://www.securitytracker.com/id?1022902 http://secunia.com/advisories/36718