Vulnerability in Mathsoft Mathcad
CVE-2006-7037
Mathcad 12 through 13.1 allows local users to bypass the security features by directly accessing or editing the XML representation of the worksheet with a text editor or other program, which allows attackers to (1) bypass password protection by replacing the password field with a hash of a known password, (2) modify timestamps to avoid detection of modifications, (3) remove locks by removing the "is-locked" attribute, and (4) view locked data, which is stored in plaintext.
EPSS: 0.003 (24.6th percentile) — read the EPSS interpretation.
Affected products
- Mathsoft Mathcad — versions 12, 13, 13.1
- Microsoft Windows_2000
- Microsoft Windows_2003_server — versions sp2
- Microsoft Windows_95
- Microsoft Windows_98
- Microsoft Windows_98se
- Microsoft Windows_me
- Microsoft Windows_nt — versions 4.0
- Microsoft Windows_xp
- N/a — versions n/a
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_SREASON, third-party-advisory)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
- cve@mitre.org (vdb-entry, x_refsource_XF)