CVE-2009-2945 - CVE House
Back to Database
Status published Medium CVE-2009-2945

weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth...

Vulnerability Description

weblogin/login.fcgi (aka the WebLogin login script) in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading (1) web-server access logs, (2) web-server Referer logs, or (3) the browser history.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-2945

Credits & Attribution

No credits recorded in the NVD database.

References

More from stanford

View All →
CVE-2021-44550
An Incorrect Access Control vulnerability exists in CoreNLP 4.3.2 via...
Critical 9.8

Affected Vendor

Affected Software

webauth
Vulnerable Versions:
3.5.5, 3.6.0, 3.6.1

Timeline

Official Publish: September 15th, 2009
Last Modified: September 16th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.