CVE-2017-9557
HighSummary
Versions 2.0 to 3.1 of EFS Software Easy Chat Server contain a vulnerability that allows remote attackers to discover passwords by sending the username parameter along with an empty password parameter and reading the HTML source code of the response.
Risk Assessment
This vulnerability may lead to the exposure of user passwords, creating a risk of unauthorized access to accounts and sensitive data within the organization.
Recommendation
It is recommended to update the Easy Chat Server to the latest version to eliminate this vulnerability and implement additional security measures, such as restricting access to login parameters.
Other vulnerabilities in EFS Software Easy Chat Server
See all- CVE-2017-9543High
Versions 2.0 to 3.1 of EFS Software Easy Chat Server contain a vulnerability that allows remote attackers to reset arbitrary passwords via a crafted POST request to registresult.htm.
- CVE-2017-9544Critical
There is a remote stack-based buffer overflow in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. An attacker may send an overly long username string to registresult.htm, potentially allowing arbitrary code execution.
Original NVD description (English source)
register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by sending the username parameter in conjunction with an empty password parameter, and reading the HTML source code of the response.