CVE-2004-2578: phpGroupWare before 0.9.16.002 transmits the (1) header admin and (2) setup passwords in plaintext via cook...

Security readout for executives and security teams

phpGroupWare versions before 0.9.16.002 reportedly placed admin and setup passwords in cookies without protecting them. Anyone able to observe the traffic could capture those passwords. This is mainly a legacy exposure concern: find any old phpGroupWare installations and prevent administrator use until the version and transport protections are confirmed. Exposure is likely limited to legacy phpGroupWare deployments earlier than 0.9.16.002, especially where admin or setup workflows are reachable over observable networks or non-encrypted HTTP. The provided sources list affected vendor and product fields as n/a, so inventory confirmation is required. Prioritize as a legacy credential-exposure issue. It is not listed as actively exploited in the provided evidence, but captured admin or setup passwords can lead to account compromise. The main business task is confirming whether obsolete phpGroupWare exists and removing or upgrading it. Mitigation focus: Inventory systems for phpGroupWare and identify exact versions.; Upgrade versions before 0.9.16.002 according to vendor guidance.; Restrict access to admin and setup interfaces to trusted networks..

Prepared

Jun 29, 2026, 16:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.