Lucene search

[email protected]CVE-2006-4099

HistoryNov 29, 2006 - 5:28 p.m.

CVE-2006-4099

2006-11-2917:28:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

cve-2006-4099

business objects

crystal enterprise

session hijacking

remote attackers

security vulnerability

7.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

88.1%

JSON

Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values.

CPENameOperatorVersion
businessobjects:crystal_enterprisebusinessobjects crystal enterpriseeq9
businessobjects:crystal_enterprisebusinessobjects crystal enterpriseeq10

CPE	Name	Operator	Version
businessobjects:crystal_enterprise	businessobjects crystal enterprise	eq	9
businessobjects:crystal_enterprise	businessobjects crystal enterprise	eq	10

References

secunia.com/advisories/23137

support.businessobjects.com/communityCS/FilesAndUpdates/ce10win_en.pdf

www.mwrinfosecurity.com/advisories/MWR_crystal-reports-weak-sessions-advisory_2006-11-28.pdf

www.securityfocus.com/bid/21350

www.uniras.gov.uk/niscc/docs/re-20061128-00818.pdf

www.vupen.com/english/advisories/2006/4748

exchange.xforce.ibmcloud.com/vulnerabilities/30568

7.5 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.018 Low

EPSS

Percentile

88.1%

JSON