PT-2006-4942 · Business Objects · Business Objects Crystal Enterprise

Published 2006-11-29 · Updated 2017-07-20 · CVE-2006-4099

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Business Objects Crystal Enterprise versions 9 through 10

Description The issue allows remote attackers to hijack sessions of other users due to the generation of predictable session identifiers. This is achieved via WCSID cookie values.

Recommendations For Business Objects Crystal Enterprise versions 9 through 10, consider regenerating session identifiers with improved randomness to prevent predictability and potential session hijacking. As a temporary workaround, restrict access to sensitive operations that rely on session identifiers to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4099

Affected Products

Business Objects Crystal Enterprise

References · 8

• http://mwrinfosecurity.com/advisories/MWR_crystal-reports-weak-sessions-advisory_2006-11-28.pdf · Vendor Advisory
• http://uniras.gov.uk/niscc/docs/re-20061128-00818.pdf · Vendor Advisory
• http://secunia.com/advisories/23137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4099 · Security Note
• http://securityfocus.com/bid/21350 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30568 · Note
• http://vupen.com/english/advisories/2006/4748 · Note
• http://support.businessobjects.com/communityCS/FilesAndUpdates/ce10win_en.pdf · Note