Description
BbtsConnection_Edit.exe in Blackboard Transact Suite (formerly Blackboard Commerce Suite) before 3.6.0.2 relies on field names when determining whether it is appropriate to decrypt a connection.xml field value, which allows local users to discover the database password via a modified connection.xml file that contains an encrypted password in the <Server> field.
References (2)
Core 2
Core References
Third Party Advisory, US Government Resource x_refsource_misc
http://www.kb.cert.org/vuls/id/MAPG-86YPVM
US Government Resource third-party-advisory
x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/204055
Scores
EPSS
0.0030
EPSS Percentile
22.1%
Details
CWE
CWE-200
Status
published
Products (1)
blackboard/transact_suite
< 3.6.0.1
Published
Sep 07, 2010
Tracked Since
Feb 18, 2026