PT-2009-2069 · Unknown · Cookiecheck

Publicado 2009-04-03 · Atualizado 2017-08-17 · CVE-2008-6599

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CookieCheck version 1.0

Description The issue concerns insufficient access control in the storage of session data. Specifically, the cookiecheck.php file in CookieCheck stores session data under the web root in tmp/cc sessions, allowing remote attackers to obtain this data via a direct request. This is related to the default session save path.

Recommendations For CookieCheck version 1.0, consider restricting access to the tmp/cc sessions directory to prevent remote attackers from obtaining session data. As a temporary workaround, restrict access to the cookiecheck.php file until a proper fix is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-6599

Produtos afetados

Cookiecheck

Referências · 5

• 🔥 http://code.google.com/p/cookiecheck · Exploit
• 🔥 http://code.google.com/p/cookiecheck/source/browse/patches/cookiecheck-1.0-security-fix-1.patch?spec=svn11&r=11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6599 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49827 · Nota
• http://osvdb.org/48865 · Nota