CVE-2004-2397

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

The web-based Management Console in Blue Coat Security Gateway OS 3.0 through 3.1.3.13 and 3.2.1, when importing a private key, stores the key and its passphrase in plaintext in a log file, which allows attackers to steal digital certificates.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/11627Broken Link, Patch, Vendor Advisory
http://www.bluecoat.com/support/knowledge/advisory_private_key_compromise.htmlBroken Link, Patch, Vendor Advisory
http://www.osvdb.org/6218Broken Link
http://www.securityfocus.com/bid/10371Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/16182Third Party Advisory, VDB Entry
http://secunia.com/advisories/11627Broken Link, Patch, Vendor Advisory
http://www.bluecoat.com/support/knowledge/advisory_private_key_compromise.htmlBroken Link, Patch, Vendor Advisory
http://www.osvdb.org/6218Broken Link
http://www.securityfocus.com/bid/10371Broken Link, Patch, Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/16182Third Party Advisory, VDB Entry

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-23982.1Netenberg Fantastico De Luxe 2.8 uses database file names that contain the associated usernames, which allows local users to determine valid CVE-2004-23995.0Secure Computing Corporation Sidewinder G2 6.1.0.01 allows remote attackers to cause a denial of service (CPU consumption) via delayed respo CVE-2004-24002.1WinFTP Server 1.6 stores username and password credentials in plaintext in the data\user.wfd file, which allows local users to gain access t CVE-2004-24017.5Stack-based buffer overflow in Ipswitch IMail Express Web Messaging before 8.05 might allow remote attackers to execute arbitrary code via a CVE-2004-24024.3Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML v CVE-2004-240310.0Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the admin CVE-2004-24056.4Buffer overflow in multiple F-Secure Anti-Virus products, including F-Secure Anti-Virus 5.42 and earlier, allows remote attackers to bypass CVE-2004-240610.0Unknown "overflow" in the phpgw_config table for phpGroupWare before 0.9.14.002 has unknown attack vectors and impact.CVE-2004-240710.0Unknown vulnerability in phpGroupWare before 0.9.14.002 has unknown attack vectors and impact, related to a "security hole" in the Setup/Con CVE-2004-24083.6Linux VServer 1.27 and earlier, 1.3.9 and earlier, and 1.9.1 and earlier shares /proc permissions across all virtual and host servers, which CVE-2004-24097.2Buffer overflow in the sh_hash_compdata function for Samhain 1.8.9 through 2.0.1, when running in update mode ("-t update"), might allow att CVE-2004-24102.1Unknown vulnerability in sh_hash_compdata for Samhain 1.8.9 through 2.0.1 might allow attackers to cause a denial of service (null pointer d