1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Home
  2. Security
  3. Security Lab
  4. Latest Threats
  5. Vulnerability Descriptions
  6. SA32264

Websense SQL Password Disclosure Security Issue

Report ID: SA32264
Source: Secunia
Date of Discovery: 14.10.2008
Criticality: Low
Affects:
Websense 6.x
Compromise From: Local system
Compromise Type: Exposure of sensitive information

Summary

A security issue in Websense, which can be exploited by malicious, local users to disclose sensitive information.

Detailed Description

A security issue in Websense, which can be exploited by malicious, local users to disclose sensitive information.

The security issue is caused due to the Websense Reporter Module storing the password for the administrative SQL user in plain text in the file "CreateDbInstall.log" within a accessible zip file in the installation directory.

The security issue is reported in the Websense Reporter Module in Websense version 6.3.2. Other versions may also be affected.

Solution

Grant only trusted users access to affected systems.