CVE-2013-4725

2014-06-0614:55:04

CWE-200

[email protected]

web.nvd.nist.gov

cve-2013-4725

ddsn interactive

cm3 acora cms

cookie security

https

remote attack

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.5%

JSON

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected configurations

NVD

Node

ddsncm3_acora_content_management_systemMatch5.5.0\/1b-p1

ddsncm3_acora_content_management_systemMatch5.5.7\/12b

ddsncm3_acora_content_management_systemMatch6.0.2\/1a

ddsncm3_acora_content_management_systemMatch6.0.6\/1a

CPENameOperatorVersion
ddsn:cm3_acora_content_management_systemddsn cm3 acora content management systemeq5.5.0\/1b-p1
ddsn:cm3_acora_content_management_systemddsn cm3 acora content management systemeq5.5.7\/12b
ddsn:cm3_acora_content_management_systemddsn cm3 acora content management systemeq6.0.2\/1a
ddsn:cm3_acora_content_management_systemddsn cm3 acora content management systemeq6.0.6\/1a

CPE	Name	Operator	Version
ddsn:cm3_acora_content_management_system	ddsn cm3 acora content management system	eq	5.5.0\/1b-p1
ddsn:cm3_acora_content_management_system	ddsn cm3 acora content management system	eq	5.5.7\/12b
ddsn:cm3_acora_content_management_system	ddsn cm3 acora content management system	eq	6.0.2\/1a
ddsn:cm3_acora_content_management_system	ddsn cm3 acora content management system	eq	6.0.6\/1a