PT-2015-3325 · Red Hat · Red Hat Amq

Naftali Rosenbaum · Publicado 2015-07-31 · Atualizado 2021-01-05 · CVE-2015-5183

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat AMQ (affected versions not specified)

Description The issue is related to the absence of HTTPOnly and Secure attributes on cookies in the console of Red Hat AMQ. This could allow a remote attacker to reuse the session identifier of an authenticated user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2017-02346

CVE-2015-5183

Produtos afetados

Red Hat Amq

Referências · 10

• https://lists.apache.org/thread.html/r63480b481eb5922465da102d97d0906d8823687f99ef3255ebc32be8%40%3Cdev.activemq.apache.org%3E · Nota
• https://bdu.fstec.ru/vul/2017-02346 · Nota de Segurança
• https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1249182 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r51c60b28154fe7b634e5f5b7a7fc7f6f060487b39a7b5e95e2c32047%40%3Cdev.activemq.apache.org%3E · Nota
• https://access.redhat.com/errata/RHSA-2018:2840 · Aviso do Fabricante
• https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E · Nota
• https://t.me/cvenotify/8182 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2015-5183 · Nota de Segurança
• http://securitytracker.com/id/1041750 · Nota