CVE-2018-11639

HIGH

Dialogic PowerMedia XMS < 3.5 - Plaintext Password Exposure in Login Cookie

Title source: llm
STIX 2.1

Description

Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://d3adend.org/blog/?p=1398

Scores

CVSS v3 8.1
EPSS 0.0111
EPSS Percentile 61.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-522
Status published
Products (2)
dialogic/powermedia_xms 3.5 su1
dialogic/powermedia_xms < 3.5
Published Jul 03, 2018
Tracked Since Feb 18, 2026