CVE:CVE-2004-2578
CNNVD:CNNVD-200412-721
phpGroupWare 0.9.16.002以前的版本借助cookies以明文方式发送(1)header admin和(2)setup密码。远程攻击者利用该漏洞嗅探密码。
solution:Upgrade phpgroupware phpgroupware to a higher version than 0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.9_pl1,0.9.10,0.9.12,0.9.13,0.9.14.003,0.9.14.005,0.9.14.006,0.9.14.007,0.9.16.000,0.9.16.001,and avoid the version 0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.9_pl1,0.9.10,0.9.12,0.9.13,0.9.14.003,0.9.14.005,0.9.14.006,0.9.14.007,0.9.16.000,0.9.16.001