CVE-2010-1507

WebYaST in yast2-webclient in SUSE Linux Enterprise (SLE) 11 on the WebYaST appliance uses a fixed secret key that is embedded in the appliance's image, which allows remote attackers to spoof session cookies by leveraging knowledge of this key.

Score

CVSS 2.0 5.0 Medium

Status

Modified - cve@mitre.org

Published

2010-09-03

Last modified

2024-09-16

Weaknesses

CWE-255

Affected products

• Suse Linux (Novell)

References

• http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
• http://support.novell.com/security/cve/CVE-2010-1507.html
• http://www.securityfocus.com/bid/42128
• https://bugzilla.novell.com/show_bug.cgi?id=591345
• https://bugzilla.novell.com/show_bug.cgi?id=598834