The Web Reports Server for SurfControl SuperScout WebFilter stores the scwebusers username and password file in a web-accessible directory, which allows remote attackers to obtain valid usernames and crack the passwords.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Superscout_web_filter | Surfcontrol | 3.0 (including) | 3.0 (including) |
| Superscout_web_filter | Surfcontrol | 3.0.3 (including) | 3.0.3 (including) |
| Web_filter | Surfcontrol | 4.0 (including) | 4.0 (including) |
| Web_filter | Surfcontrol | 4.1 (including) | 4.1 (including) |