PT-2010-3856 · Accoria · Accoria Web Server

Ilja Van Sprundel · Published 2010-06-14 · Updated 2010-06-17 · CVE-2010-2270

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Accoria Web Server (aka Rock Web Server) version 1.4.7

Description The issue makes it easier for remote attackers to hijack sessions. This is due to the use of a predictable httpmod-sessionid cookie.

Recommendations For Accoria Web Server (aka Rock Web Server) version 1.4.7, consider regenerating session IDs to prevent session hijacking until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2010-2270

Affected Products

Accoria Web Server

References · 3

• 🔥 http://ioactive.com/pdfs/AccoriaWebServer.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2270 · Security Note
• http://kb.cert.org/vuls/id/245081 · Note