PT-2007-5326 · Hitachi · Cosminexus Component Container+1

Publicado 2007-08-01 · Atualizado 2017-07-29 · CVE-2007-4124

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cosminexus versions prior to 20070731 Cosminexus Component Container in Cosminexus 6 Cosminexus Component Container in Cosminexus 6.7 Cosminexus Component Container in Cosminexus 7

Description The issue concerns the session failover function in Cosminexus Component Container. Under unspecified conditions, it can use session data for the wrong user. This might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.

Recommendations For Cosminexus versions prior to 20070731, update to a version released after 20070731 to resolve the issue. For Cosminexus 6, consider disabling the session failover function until a patch is available. For Cosminexus 6.7, restrict access to sensitive information to minimize the risk of exploitation. For Cosminexus 7, avoid using the session failover function in multi-user environments until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-4124

Produtos afetados

Cosminexus

Cosminexus Component Container

Referências · 7

• http://vupen.com/english/advisories/2007/2725 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-4124 · Nota de Segurança
• http://hitachi-support.com/security_e/vuls_e/HS07-024_e/index-e.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35706 · Nota
• http://osvdb.org/37852 · Nota
• http://secunia.com/advisories/26250 · Aviso do Fabricante
• http://securityfocus.com/bid/25145 · Nota