PT-2009-4617 · Serendipity · Serendipity

Publicado 2009-06-22 · Atualizado 2009-06-26 · CVE-2009-2165

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SerendipityNZ (aka SimpleBoxes) Serene Bach versions 2.20R and earlier SerendipityNZ (aka SimpleBoxes) Serene Bach versions 3.00 beta023 and earlier

Description The issue allows remote attackers to hijack sessions due to the use of a predictable session id.

Recommendations For versions 2.20R and earlier, update to a version later than 2.20R to resolve the issue. For versions 3.00 beta023 and earlier, update to a version later than 3.00 beta023 to resolve the issue. As a temporary workaround, consider regenerating session ids regularly until a patch is available.

Correção

Identificadores relacionados

CVE-2009-2165

Produtos afetados

Serendipity

Referências · 6

• http://jvn.jp/en/jp/JVN20689557/index.html · Nota
• http://serenebach.net/log/sb221R.html · Aviso do Fabricante
• http://secunia.com/advisories/35335 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-2165 · Nota de Segurança
• http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000035.html · Nota
• http://securityfocus.com/bid/35254 · Nota