PT-2006-4942 · Business Objects · Business Objects Crystal Enterprise

Publicado 2006-11-29 · Atualizado 2017-07-20 · CVE-2006-4099

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Business Objects Crystal Enterprise versions 9 through 10

Description The issue allows remote attackers to hijack sessions of other users due to the generation of predictable session identifiers. This is achieved via WCSID cookie values.

Recommendations For Business Objects Crystal Enterprise versions 9 through 10, consider regenerating session identifiers with improved randomness to prevent predictability and potential session hijacking. As a temporary workaround, restrict access to sensitive operations that rely on session identifiers to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-4099

Produtos afetados

Business Objects Crystal Enterprise

Referências · 8

• http://securityfocus.com/bid/21350 · Nota
• http://mwrinfosecurity.com/advisories/MWR_crystal-reports-weak-sessions-advisory_2006-11-28.pdf · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30568 · Nota
• http://vupen.com/english/advisories/2006/4748 · Nota
• http://uniras.gov.uk/niscc/docs/re-20061128-00818.pdf · Aviso do Fabricante
• http://support.businessobjects.com/communityCS/FilesAndUpdates/ce10win_en.pdf · Nota
• http://secunia.com/advisories/23137 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2006-4099 · Nota de Segurança