Ariba password exposure vulnerability

[gerald626 () gmail com]

The Ariba Spend Mangement System, which is a web-based application, appears to transmit the username and password of 
the user to the server via the URL in plain text.  Packet capture is available for analysis upon request.

This may enable a malicious user to sniff the username/password for accounts in the 'approval' role (for example, the 
CFO/CTO/CEO), which would allow the user to purchase items they are not normally permitted to.

Gerald.