vendor:
TIBCO RendezVous
by:
Andres Tarasco Acuña
5.5
CVSS
MEDIUM
Password extraction
311
CWE
Product Name: TIBCO RendezVous
Affected Version From: <=7.4.11
Affected Version To: 7.4.11
Patch Exists: NO
Related CWE: Not available
CPE: a:tibco:rendezvous
Platforms Tested: Windows
Unknown
TIBCO RendezVous local password extractor
This exploit allows an attacker to extract login credentials from TIBCO RendezVous version <=7.4.11. The passwords are stored in base64 format without encryption and the password file is accessible to everyone. This vulnerability affects the Windows environment.
Mitigation:
The vendor should add restrictive ACLs to prevent data leakage.