CVE-2012-2735

Published Sep 28, 2012

Last updated 2 years ago

Overview

Description: Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie.
Source: secalert@redhat.com
NVD status: Modified

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.9
Impact score: 4.9
Exploitability score: 6.8
Vector string: AV:N/AC:M/Au:S/C:P/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Hype score: Not currently trending

Evaluator

Comment: Per: http://cwe.mitre.org/data/definitions/384.html 'CWE-384: Session Fixation'
Impact: Per: http://rhn.redhat.com/errata/RHSA-2012-1278.html " An authenticated user able to pre-set the Cumin session cookie in a victim's browser could possibly use this flaw to steal the victim's session after they log into Cumin."
Solution: Per: http://rhn.redhat.com/errata/RHSA-2012-1278.html " An authenticated user able to pre-set the Cumin session cookie in a victim's browser could possibly use this flaw to steal the victim's session after they log into Cumin."

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EB8CE3E6-C78F-4363-B731-A7981046EE5B",
            "versionEndIncluding": "0.1.5192-4"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B33C6617-24FB-4C96-A786-D26B074B0569"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D6CF3F68-713E-48E8-8D37-4AE443AF87FC"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8BDF4FB8-5ECF-4A2F-8066-8C362574B55F"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6ADC326A-3CE8-4710-870B-BF540CCB4A5E"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FFB4776E-178C-4488-9C98-98859576E343"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "77B6E427-B880-48EB-8139-2F54381539BB"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5033-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9EABF881-94BA-4E76-8EDB-29A4DB7F68B1"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5037-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "476B4482-38CB-46FB-B05D-CBBCDA87B739"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5054-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F49E39C4-D9D4-44D0-9F24-2DB3EB1E4457"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5068-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "75A69413-E0B0-4528-8C42-898866BD3B9B"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5092-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "00B69A8C-A652-4CBB-80B1-171630C7420E"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "11E7AFB1-7864-47D4-AD75-9B9950BE7BBB"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5105-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B9C553FD-1ED7-436A-B4A7-309C79CB7793"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4CBBA885-F992-464D-9DF4-047F824FC02B"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D313A509-35AE-4EA3-9EDC-20CA98293D99"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B84531E0-D82D-43AE-A708-B12C34984B70"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9106FF80-627C-40E1-80E1-E574EB9A6B8C"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F46220E7-B924-49D4-B866-3EA6B52F4D45"
          },
          {
            "criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CACA1231-8272-40A9-B7B3-0141E0F1D7A7"
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C60FA8B1-1802-4522-A088-22171DCF7A93"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 2.0

Weaknesses

Social media

Evaluator

Configurations

References