CVE-1999-1271: Weak Encryption
Macromedia Dreamweaver uses weak encryption to store FTP passwords, which could allow local users to easily decrypt the passwords of other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Do not store FTP passwords in Dreamweaver. Configure the application to prompt for FTP credentials each session or avoid saving passwords in the application settings.
Adobe Dreamweaver 2021 store FTP passwords = disabled - Compensating control
Restrict local access to machines running Dreamweaver to trusted, authorized users only and enforce least-privilege access to user profiles and application data to prevent other local users from accessing stored credentials.
- Operational
Delete or clear any FTP credentials and saved connection entries stored by Dreamweaver for all users on affected systems.
- Operational
Rotate (change) FTP account passwords that were stored in Dreamweaver and update any systems or services that use those credentials.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1271?
CVE-1999-1271 is considered a low severity vulnerability, mainly due to its impact being localized to the user's system.
How do I fix CVE-1999-1271?
To fix CVE-1999-1271, it is recommended to upgrade to a version of Macromedia Dreamweaver that uses stronger encryption for storing FTP passwords.
What are the potential risks of CVE-1999-1271?
The risks of CVE-1999-1271 include unauthorized local access to FTP credentials, which could lead to data breaches or account hijacking.
Who is affected by CVE-1999-1271?
CVE-1999-1271 affects users of Macromedia Dreamweaver who utilize the FTP functionality and rely on the application's built-in password storage.
What version of Dreamweaver is affected by CVE-1999-1271?
CVE-1999-1271 specifically affects the initial version of Macromedia Dreamweaver.