CallBackery before 0.62.0 has password and session flaws
The note describes unsalted HMAC-SHA1 passwords, cookie forgery via rand(), and session cookies accepted at any age.
52
CVE-2026-118990
Insecure config dump in CallBackery before 0.62.0
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CallBackery for Perl, before 0.62.0, writes a configuration-database dump to the predictable path /tmp/cbdump during a backup and never removes it. getConfigBlob() uses the sqlite3 shell; the file follows the process umask and a planted symlink is followed. A local user can read every user's password hash and every form value after any backup, or redirect the dump to a chosen file.
What to do: Upgrade CallBackery to 0.62.0 or later.
| Product | Affected | Fixed in |
|---|---|---|
| CallBackery | before 0.62.0 | 0.62.0 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed. The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.
- Weakness
- CWE-59, CWE-379
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N