High severity · published Dec 31, 2001
CVE-2001-1537
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain…
7.5
CVSS
1.1%
EPSS
No
On KEV
Description
The default "basic" security setting' in config.php for TWIG webmail 2.7.4 and earlier stores cleartext usernames and passwords in cookies, which could allow attackers to obtain authentication information and gain privileges.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
Twig · Symfony
through 2.7.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2001-1537
CVE.org
https://www.cve.org/CVERecord?id=CVE-2001-1537
Broken Link
http://archives.neohapsis.com/archives/bugtraq/2001-11/0245.html
Broken Link
http://www.iss.net/security_center/static/7619.php
Broken Link
http://www.securityfocus.com/bid/3591
More from Twig
9.9
CVE-2026-24425
Twig 2.16.x & 3.9.0-3.25.x Sandbox Bypass via SourcePolicyInterface
9.8
CVE-2026-46634
Twig: `template_from_string()` escapes a SourcePolicy-driven sandbox via synthesized template name
9.8
CVE-2026-46633
Twig: PHP code injection via `{% use %}` template name
9.8
CVE-2022-23614
Twig is an open source template language for PHP
9.8
CVE-2018-13818
Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter