PT-2009-2069 · Unknown · Cookiecheck

Published 2009-04-03 · Updated 2017-08-17 · CVE-2008-6599

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions CookieCheck version 1.0

Description The issue concerns insufficient access control in the storage of session data. Specifically, the cookiecheck.php file in CookieCheck stores session data under the web root in tmp/cc sessions, allowing remote attackers to obtain this data via a direct request. This is related to the default session save path.

Recommendations For CookieCheck version 1.0, consider restricting access to the tmp/cc sessions directory to prevent remote attackers from obtaining session data. As a temporary workaround, restrict access to the cookiecheck.php file until a proper fix is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-6599

Affected Products

Cookiecheck

References · 5

• 🔥 http://code.google.com/p/cookiecheck · Exploit
• 🔥 http://code.google.com/p/cookiecheck/source/browse/patches/cookiecheck-1.0-security-fix-1.patch?spec=svn11&r=11 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6599 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49827 · Note
• http://osvdb.org/48865 · Note