PT-2006-4892 · Netious · Netious Cms

Published 2006-08-09 · Updated 2017-07-20 · CVE-2006-4048

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Netious CMS version 0.4

Description The issue allows remote attackers to gain access to the administration section when originating from the same IP address as the administrator, due to session IDs being initialized based on the client IP address.

Recommendations For Netious CMS version 0.4, consider implementing a more secure session ID generation mechanism that does not rely solely on the client IP address, such as using a random or cryptographically secure token. As a temporary workaround, restrict access to the administration section to trusted IP addresses or networks until a more secure solution is implemented.

Fix

Related Identifiers

CVE-2006-4048

Affected Products

Netious Cms

References · 7

• http://secunia.com/advisories/21347 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4048 · Security Note
• http://securityfocus.com/bid/19421 · Note
• http://vupen.com/english/advisories/2006/3167 · Note
• http://osvdb.org/27789 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28264 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4048 · Note