CVE-2001-1537: High severity Symfony Twig vulnerability
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2001-1537?
CVE-2001-1537 has a high severity level due to the exposure of cleartext usernames and passwords in cookies.
How do I fix CVE-2001-1537?
To fix CVE-2001-1537, update to a version of TWIG webmail later than 2.7.4 that has addressed this security issue.
Who is affected by CVE-2001-1537?
CVE-2001-1537 affects users of TWIG webmail versions 2.7.4 and earlier, as well as Symfony Twig versions up to 2.7.4.
What is the impact of CVE-2001-1537?
The impact of CVE-2001-1537 could allow attackers to gain unauthorized access to user accounts by stealing authentication information.
Is there a workaround for CVE-2001-1537?
A temporary workaround for CVE-2001-1537 includes disabling cookies or implementing alternative secure authentication methods.