CVE-2013-7347

Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.

Score

CVSS 2.0 3.7 Low

Status

Modified - cve@mitre.org

Published

2014-03-31

Last modified

2024-08-06

Weaknesses

CWE-264

Affected products

• Conga (Redhat)
• Enterprise Linux (Redhat)

References

• http://rhn.redhat.com/errata/RHSA-2013-0128.html
• https://bugzilla.redhat.com/show_bug.cgi?id=607179