PT-2009-1296 · Futomi · Futomi Cgi Cafe Access Analyzer Cgi Standard+1

Publicado 2009-01-02 · Atualizado 2009-02-26 · CVE-2008-5809

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions futomi CGI Cafe Access Analyzer CGI Standard versions 4.0.1 and earlier futomi CGI Cafe Access Analyzer CGI Professional versions 4.11.3 and earlier

Description The issue allows remote attackers to hijack sessions and obtain sensitive information about analysis results via a modified id. This is due to the use of a predictable session id.

Recommendations For futomi CGI Cafe Access Analyzer CGI Standard versions 4.0.1 and earlier, update to a version later than 4.0.1 to resolve the issue. For futomi CGI Cafe Access Analyzer CGI Professional versions 4.11.3 and earlier, update to a version later than 4.11.3 to resolve the issue. As a temporary workaround, consider regenerating session ids to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-5809

Produtos afetados

Futomi Cgi Cafe Access Analyzer Cgi Professional

Futomi Cgi Cafe Access Analyzer Cgi Standard

Referências · 5

• http://futomi.com/library/info/2008/20081212.html · Aviso do Fabricante
• http://securityfocus.com/bid/32794 · Nota
• http://jvn.jp/en/jp/JVN07468800/index.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5809 · Nota de Segurança
• http://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-000083.html · Nota