PT-2006-1478 · Claroline · Claroline

Publicado 2006-01-25 · Atualizado 2017-07-20 · CVE-2006-0411

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Claroline version 1.7.2

Description The issue concerns the use of guessable session cookies in the claro init local.inc.php file, which are generated as an MD5 hash of the connection time. This allows remote attackers to potentially hijack sessions, possibly leading to the gain of administrative privileges.

Recommendations For Claroline version 1.7.2, consider regenerating session cookies using a more secure method to prevent session hijacking, and restrict access to administrative privileges until a proper fix is applied. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-0411

Produtos afetados

Claroline

Referências · 7

• http://secunia.com/advisories/18588 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0411 · Nota
• http://vupen.com/english/advisories/2006/0320 · Nota
• http://securityfocus.com/bid/16341 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24326 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-0411 · Nota de Segurança
• http://securityfocus.com/archive/1/422482 · Nota