Description
Intellisol Xpede 4.1 stores passwords in plaintext in a Javascript "session timeout" re-authentication capability, which could allow local users with access to gain privileges of other Xpede users by reading the password from the source file, e.g. from the browser's cache.
References
- 20020322 Xpede passwords exposed (2 vuln.) mailing-list
- xpede-reauth-plaintext-password(8612) vdb-entry
- 4346 vdb-entry