PT-2002-2064 · Cobalt · Cobalt Qube

Published 2002-08-31 · Updated 2008-09-05 · CVE-2002-1058

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cobalt Qube version 3.0

Description: A directory traversal issue exists in the splashAdmin.php file, allowing local users and remote attackers to gain privileges as the Qube Admin. This is achieved by using .. (dot dot) sequences in the sessionId cookie to point to an alternate session file.

Recommendations: For Cobalt Qube version 3.0, consider restricting access to the splashAdmin.php file until a patch is available. As a temporary workaround, avoid using the sessionId cookie with .. (dot dot) sequences to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2002-1058

Affected Products

Cobalt Qube

References · 6

• 🔥 http://securityfocus.com/bid/5297 · Exploit
• 🔥 https://exploit-db.com/exploits/21640 · Exploit
• http://iss.net/security_center/static/9669.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1058 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1058 · Note
• http://archives.neohapsis.com/archives/bugtraq/2002-07/0261.html · Note