PT-2006-4892 · Netious · Netious Cms

Publicado 2006-08-09 · Atualizado 2017-07-20 · CVE-2006-4048

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netious CMS version 0.4

Description The issue allows remote attackers to gain access to the administration section when originating from the same IP address as the administrator, due to session IDs being initialized based on the client IP address.

Recommendations For Netious CMS version 0.4, consider implementing a more secure session ID generation mechanism that does not rely solely on the client IP address, such as using a random or cryptographically secure token. As a temporary workaround, restrict access to the administration section to trusted IP addresses or networks until a more secure solution is implemented.

Correção

Identificadores relacionados

CVE-2006-4048

Produtos afetados

Netious Cms

Referências · 7

• http://securityfocus.com/bid/19421 · Nota
• http://vupen.com/english/advisories/2006/3167 · Nota
• http://osvdb.org/27789 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28264 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4048 · Nota
• http://secunia.com/advisories/21347 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-4048 · Nota de Segurança