CVE-2007-4961 json
The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login…
published 2007-09-18 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4942
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
The login_to_simulator method in Linden Lab Second Life, as used by the secondlife:// protocol handler and possibly other Second Life login mechanisms, sends an MD5 hash in cleartext in the passwd field, which allows remote attackers to login to an account by sniffing the network and then sending this hash to a Second Life authentication server.
Exploit prediction
1.27% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gnucitizen.org http://www.gnucitizen.org/blog/ie-pwns-secondlife referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-311 Missing Encryption of Sensitive Data
References
-
gnucitizen.org
/blog/ie-pwns-secondlife
exploit
-
osvdb.org
/45947
vdb-entry, broken-link
Sources
- CVE List CVE-2007-4961
- NVD CVE-2007-4961
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.