PT-2010-3856 · Accoria · Accoria Web Server

Ilja Van Sprundel · Publicado 2010-06-14 · Atualizado 2010-06-17 · CVE-2010-2270

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Accoria Web Server (aka Rock Web Server) version 1.4.7

Description The issue makes it easier for remote attackers to hijack sessions. This is due to the use of a predictable httpmod-sessionid cookie.

Recommendations For Accoria Web Server (aka Rock Web Server) version 1.4.7, consider regenerating session IDs to prevent session hijacking until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2010-2270

Produtos afetados

Accoria Web Server

Referências · 3

• 🔥 http://ioactive.com/pdfs/AccoriaWebServer.pdf · Exploit
• http://kb.cert.org/vuls/id/245081 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2270 · Nota de Segurança