Lucene search

[email protected]CVE-2008-5809

HistoryJan 02, 2009 - 6:11 p.m.

CVE-2008-5809

2009-01-0218:11:09

CWE-287

[email protected]

web.nvd.nist.gov

futomi

cgi cafe

access analyzer

predictable session id

remote attackers

session hijacking

sensitive information

nvd

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.3 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.8%

JSON

futomi CGI Cafe Access Analyzer CGI Standard 4.0.1 and earlier and Access Analyzer CGI Professional 4.11.3 and earlier use a predictable session id, which makes it easier for remote attackers to hijack sessions, and obtain sensitive information about analysis results, via a modified id.

Affected configurations

NVD

Node

futomiaccess_analyzer_cgiRange≤4.0.1std

futomiaccess_analyzer_cgiMatch_nil_beta1pro

futomiaccess_analyzer_cgiMatch_nil_beta2pro

futomiaccess_analyzer_cgiMatch1.0pro

futomiaccess_analyzer_cgiMatch1.1pro

futomiaccess_analyzer_cgiMatch1.1std

futomiaccess_analyzer_cgiMatch1.2pro

futomiaccess_analyzer_cgiMatch1.2std

futomiaccess_analyzer_cgiMatch1.3pro

futomiaccess_analyzer_cgiMatch1.3std

futomiaccess_analyzer_cgiMatch1.4pro

futomiaccess_analyzer_cgiMatch1.4std

futomiaccess_analyzer_cgiMatch1.5pro

futomiaccess_analyzer_cgiMatch1.6pro

futomiaccess_analyzer_cgiMatch1.7pro

futomiaccess_analyzer_cgiMatch2.0pro

futomiaccess_analyzer_cgiMatch2.0std

futomiaccess_analyzer_cgiMatch2.1pro

futomiaccess_analyzer_cgiMatch2.1std

futomiaccess_analyzer_cgiMatch2.2pro

futomiaccess_analyzer_cgiMatch2.2std

futomiaccess_analyzer_cgiMatch2.3pro

futomiaccess_analyzer_cgiMatch2.3std

futomiaccess_analyzer_cgiMatch2.4pro

futomiaccess_analyzer_cgiMatch2.4std

futomiaccess_analyzer_cgiMatch3.0pro

futomiaccess_analyzer_cgiMatch3.0std

futomiaccess_analyzer_cgiMatch3.1pro

futomiaccess_analyzer_cgiMatch3.1std

futomiaccess_analyzer_cgiMatch3.2pro

futomiaccess_analyzer_cgiMatch3.2std

futomiaccess_analyzer_cgiMatch3.3pro

futomiaccess_analyzer_cgiMatch3.3std

futomiaccess_analyzer_cgiMatch3.4pro

futomiaccess_analyzer_cgiMatch3.4std

futomiaccess_analyzer_cgiMatch3.5pro

futomiaccess_analyzer_cgiMatch3.5std

futomiaccess_analyzer_cgiMatch3.6std

futomiaccess_analyzer_cgiMatch3.7std

futomiaccess_analyzer_cgiMatch3.8std

futomiaccess_analyzer_cgiMatch3.8.1std

futomiaccess_analyzer_cgiMatch4.0pro

futomiaccess_analyzer_cgiMatch4.0.0std

futomiaccess_analyzer_cgiMatch4.1pro

futomiaccess_analyzer_cgiMatch4.2pro

futomiaccess_analyzer_cgiMatch4.3pro

futomiaccess_analyzer_cgiMatch4.4pro

futomiaccess_analyzer_cgiMatch4.5pro

futomiaccess_analyzer_cgiMatch4.6pro

futomiaccess_analyzer_cgiMatch4.7pro

futomiaccess_analyzer_cgiMatch4.8pro

futomiaccess_analyzer_cgiMatch4.9pro

futomiaccess_analyzer_cgiMatch4.10pro

futomiaccess_analyzer_cgiMatch4.10.1pro

futomiaccess_analyzer_cgiMatch4.10.2pro

futomiaccess_analyzer_cgiMatch4.10.3pro

futomiaccess_analyzer_cgiMatch4.10.4pro

futomiaccess_analyzer_cgiMatch4.10.5pro

futomiaccess_analyzer_cgiMatch4.11.0pro

futomiaccess_analyzer_cgiMatch4.11.1pro

futomiaccess_analyzer_cgiMatch4.11.2pro

futomiaccess_analyzer_cgiMatch4.11.3pro

CPENameOperatorVersion
futomi:access_analyzer_cgifutomi access analyzer cgile4.0.1
futomi:access_analyzer_cgifutomi access analyzer cgieqnil
futomi:access_analyzer_cgifutomi access analyzer cgieq1.0
futomi:access_analyzer_cgifutomi access analyzer cgieq1.1
futomi:access_analyzer_cgifutomi access analyzer cgieq1.2
futomi:access_analyzer_cgifutomi access analyzer cgieq1.3
futomi:access_analyzer_cgifutomi access analyzer cgieq1.4
futomi:access_analyzer_cgifutomi access analyzer cgieq1.5
futomi:access_analyzer_cgifutomi access analyzer cgieq1.6
futomi:access_analyzer_cgifutomi access analyzer cgieq1.7

CPE	Name	Operator	Version
futomi:access_analyzer_cgi	futomi access analyzer cgi	le	4.0.1
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	nil
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.0
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.1
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.2
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.3
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.4
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.5
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.6
futomi:access_analyzer_cgi	futomi access analyzer cgi	eq	1.7

Rows per page:

1-10 of 461

References

jvn.jp/en/jp/JVN07468800/index.html

jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000083.html

www.futomi.com/library/info/2008/20081212.html

www.securityfocus.com/bid/32794

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

6.3 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.8%

JSON

Related for CVE-2008-5809

cvelist1 jvn1 prion1 nvd1