PT-2006-1232 · 427Bb · 427Bb

Aliaksandr Hartsuyeu · Published 2006-01-10 · Updated 2018-10-19 · CVE-2006-0153

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions 427BB versions 2.2 through 2.2.1

Description The issue allows remote attackers to bypass authentication by using a valid username and usertype and setting the authenticated cookie. This is possible because the software verifies authentication credentials based on the username, authenticated, and usertype cookies.

Recommendations For versions 2.2 through 2.2.1, consider temporarily disabling the use of the authenticated cookie for authentication until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid relying solely on the username, authenticated, and usertype cookies for authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2006-0153

Affected Products

427Bb

References · 9

• 🔥 http://evuln.com/vulns/18/summary.html · Exploit
• 🔥 http://securityfocus.com/bid/16178 · Exploit
• 🔥 https://exploit-db.com/exploits/27054 · Exploit
• http://secunia.com/advisories/18354 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0153 · Security Note
• http://securityfocus.com/archive/1/421326/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24038 · Note
• http://vupen.com/english/advisories/2006/0091 · Note
• http://osvdb.org/22274 · Note