PT-2006-1478 · Claroline · Claroline

Published 2006-01-25 · Updated 2017-07-20 · CVE-2006-0411

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Claroline version 1.7.2

Description The issue concerns the use of guessable session cookies in the claro init local.inc.php file, which are generated as an MD5 hash of the connection time. This allows remote attackers to potentially hijack sessions, possibly leading to the gain of administrative privileges.

Recommendations For Claroline version 1.7.2, consider regenerating session cookies using a more secure method to prevent session hijacking, and restrict access to administrative privileges until a proper fix is applied. As a temporary workaround, consider implementing additional authentication measures to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-0411

Affected Products

Claroline

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2006-0411 · Security Note
• http://secunia.com/advisories/18588 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0411 · Note
• http://vupen.com/english/advisories/2006/0320 · Note
• http://securityfocus.com/bid/16341 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24326 · Note
• http://securityfocus.com/archive/1/422482 · Note