CVE-2014-10400

MEDIUM

6.1

Descricao

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.

Detalhes CVE

Pontuacao CVSS v3.16.1

SeveridadeMEDIUM

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosNONE

Interacao do usuarioREQUIRED

Publicado2/6/2020

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

keplerproject:cgilua

Fraquezas (CWE)

CWE-384

Referencias

http://seclists.org/fulldisclosure/2014/Apr/318(cve@mitre.org)

http://www.securityfocus.com/archive/1/531981/100/0/threaded(cve@mitre.org)

http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid(cve@mitre.org)

http://seclists.org/fulldisclosure/2014/Apr/318(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/archive/1/531981/100/0/threaded(af854a3a-2127-422b-91ae-364da2661108)

http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.