PT-2004-1969 · Mitel · Mitel 3300 Icp

Publicado 2004-02-28 · Atualizado 2008-09-05 · CVE-2004-0944

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Mitel 3300 Integrated Communications Platform (ICP) versions prior to 4.2.2.11

Description: The issue allows remote attackers to hijack other sessions due to easily predictable web session IDs generated by the web management interface. This can be achieved via the parentsessionid cookie.

Recommendations: For versions prior to 4.2.2.11, update to version 4.2.2.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the web management interface to minimize the risk of session hijacking.

Correção

Identificadores relacionados

CVE-2004-0944

Produtos afetados

Mitel 3300 Icp

Referências · 4

• http://niscc.gov.uk/niscc/docs/re-20050228-00178.pdf?lang=en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-0944 · Nota de Segurança
• http://corsaire.com/advisories/c040817-002.txt · Aviso do Fabricante
• http://mitel.com/DocController?documentId=14223 · Aviso do Fabricante