Description
Paros 3.2.5 uses a default password for the "sa" account in the underlying HSQLDB database and does not restrict access to the local machine, which allows remote attackers to gain privileges.
References
- 15141 vdb-entry
- 20060130 Re: [Full-disclosure] [ GLSA 200601-15 ] Paros: Default administrator password mailing-list
- 17089 third-party-advisory
- http://www.zone-h.com/en/advisories/read/id=8286/
- paros-password-security-bypass(22557) vdb-entry
- 18626 third-party-advisory
- GLSA-200601-15 vendor-advisory