Back to list
Ariba password exposure vulnerability
Aug 31 2005 06:04PM
gerald626 gmail com
The Ariba Spend Mangement System, which is a web-based application, appears to transmit the username and password of the user to the server via the URL in plain text. Packet capture is available for analysis upon request.
This may enable a malicious user to sniff the username/password for accounts in the 'approval' role (for example, the CFO/CTO/CEO), which would allow the user to purchase items they are not normally permitted to.
[ reply ]
Copyright 2010, SecurityFocus