3 ms·

I didn't probe it that deeply as it was just a single device I need to backdoor.. but Apache tomcat appears to suffer from this. The configuration format does

I didn't probe it that deeply as it was just a single device I need to backdoor.. but Apache tomcat appears to suffer from this. The configuration format doesn't have a prefix for hashed passwords, so just using the hash as a plaintext password worked to get access to the devices "super admin" menu.

modeless 4y ago
In Zoom's case this seems to be working as intended. Clearly you are intended to be able to join the meeting with only the hashed password, that's what the sharing URL feature is for. It's probably more of an obfuscation feature, so people don't file angry bugs about how Zoom URLs reveal the plaintext of their terrible reused password.