SurfControl SuperScout Email Filter 3.5 - User Credential Disclosure

Author: ken@FTU
type: webapps
platform: asp
port: 
date_added: 2002-10-08 
date_updated: 2012-10-12 
verified: 1 
codes: CVE-2002-1530;OSVDB-8867 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5929/info

SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities.

One of the files (userlist.asp) that comes with the web interface contains a listing of administrative usernames/passwords. Users who can access this file will gain access to authentication credentials for other users.

http://www.example.com/web/usermgr/userlist.asp