Lucene search
HistoryDec 15, 2006 - 7:00 p.m.
CVE-2003-1312
cve-2003-1312
netegrity siteminder
session id
remote attackers
security vulnerability
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
7 High
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
74.7%
siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods.
Affected configurations
Node
netegritysiteminder
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
7 High
AI Score
Confidence
Low
0.004 Low
EPSS
Percentile
74.7%
Related for CVE-2003-1312