PT-2012-4043 · Ar · Awcm

Published 2012-11-26 · Updated 2017-08-29 · CVE-2012-2437

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ar web content manager (AWCM) version 2.2

Description The issue allows remote attackers to generate arbitrary cookies without requiring authentication. This can be achieved by manipulating the name parameter in conjunction with the content parameter in the cookie gen.php file.

Recommendations For version 2.2, consider restricting access to the cookie gen.php file to require authentication before generating cookies, and validate the name and content parameters to prevent arbitrary cookie generation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2012-2437

Affected Products

Awcm

References · 5

• 🔥 https://exploit-db.com/exploits/38015 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-11/0039.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-2437 · Security Note
• http://packetstormsecurity.org/files/117975/AWCM-2.2-Access-Bypass.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79926 · Note