Published: 21/09/2007 Updated: 15/10/2018

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

ELinks prior to 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote malicious users to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Vulnerable Product	Search on Vulmon	Subscribe to Product
elinks elinks

Kalle Olavi Niemitalo discovered that if elinks makes a POST request to an HTTPS URL through a proxy, information may be sent in clear-text between elinks and the proxy Attackers with access to the network could steal sensitive information (such as passwords) ...

Debian Bug report logs - #443914 CVE-2007-5034 possible secret information disclosure Package: elinks; Maintainer for elinks is أحمد المحمودي (Ahmed El-Mahmoudy) <aelmahmoudy@userssourceforgenet>; Source for elinks is src:elinks (PTS, buildd, popcon) Reported by: Nico Golde <nion@debianorg> Date: Mon, ...

CWE-200 http://bugzilla.elinks.cz/show_bug.cgi?id=937 https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018 https://bugzilla.redhat.com/show_bug.cgi?id=297981 http://www.debian.org/security/2007/dsa-1380 https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html http://www.redhat.com/support/errata/RHSA-2007-0933.html http://www.ubuntu.com/usn/usn-519-1 http://www.securityfocus.com/bid/25799 http://www.securitytracker.com/id?1018764 http://secunia.com/advisories/26936 http://secunia.com/advisories/26956 http://secunia.com/advisories/26949 http://secunia.com/advisories/27062 http://secunia.com/advisories/27125 http://secunia.com/advisories/27132 http://secunia.com/advisories/27038 http://www.vupen.com/english/advisories/2007/3278 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335 http://www.securityfocus.com/archive/1/481606/100/0/threaded https://usn.ubuntu.com/519-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2007-5034

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect