CVE-2005-3429

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-11-02 · updated 2026-06-16

Description

Rockliffe MailSite Express before 6.1.22, with the option to save login information enabled, saves user passwords in plaintext in cookies, which allows local users to obtain passwords by reading the cookie file, or remote attackers to obtain the cookies via cross-site scripting (XSS) vulnerabilities.

Affected products

Rockliffe Mailsite Express: through 6.1.21; 6.1.20

References

http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html
http://marc.info/?l=bugtraq&m=113053680631151&w=2
http://securitytracker.com/id?1015117
http://www.osvdb.org/22682
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/22906
http://archives.neohapsis.com/archives/fulldisclosure/2005-10/0578.html
http://marc.info/?l=bugtraq&m=113053680631151&w=2
http://securitytracker.com/id?1015117
http://www.osvdb.org/22682
http://www.security-assessment.com/Advisories/Rockliffe_Express_Webmail_Vulnerabilities.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/22906

Get alerted when CVE-2005-3429 or the next vulnerability affects your stack