Lucene search

Veracode Vulnerability DatabaseVERACODE:27590

HistoryOct 16, 2020 - 5:48 a.m.

Insecure Session Management

2020-10-1605:48:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

cfme2 uses insecure session management. An attacker is able to perform session tampering attacks using the secret in the static secret_token.rb.

CPENameOperatorVersion
ruby193-rubygem-test-uniteq2.4.1__3.el6op
ruby193-rubyeq1.9.3.327__25.el6
ruby193-rubyeq1.9.3.429__34.2.el6ost
ruby193-rubyeq1.9.3.194__23.el6
ruby193-rubyeq1.9.3.429__34.el6
ruby193-rubyeq1.9.3.327__28.el6
ruby193-rubygem-rakeeq0.9.2.2__35.el6sat
ruby193-rubygem-thoreq0.15.4__2.el6
ruby193-rubygem-thoreq0.15.4__8.el6sat
ruby193-rubygem-thoreq0.15.4__1.el6

Name	Operator	Version
ruby193-rubygem-test-unit	eq	2.4.1__3.el6op
ruby193-ruby	eq	1.9.3.327__25.el6
ruby193-ruby	eq	1.9.3.429__34.2.el6ost
ruby193-ruby	eq	1.9.3.194__23.el6
ruby193-ruby	eq	1.9.3.429__34.el6
ruby193-ruby	eq	1.9.3.327__28.el6
ruby193-rubygem-rake	eq	0.9.2.2__35.el6sat
ruby193-rubygem-thor	eq	0.15.4__2.el6
ruby193-rubygem-thor	eq	0.15.4__8.el6sat
ruby193-rubygem-thor	eq	0.15.4__1.el6

Rows per page:

1-10 of 2461

References

access.redhat.com/errata/RHEA-2013:1487

access.redhat.com/site/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Technical_Notes/index.html

bugzilla.redhat.com/show_bug.cgi?id=959041

rhn.redhat.com/rhn/software/downloads/SupportedISOs.do?filter_string=CloudForms

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

JSON

Related for VERACODE:27590