Unscored severity · published Aug 1, 2007
CVE-2007-4124
The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the…
–
CVSS
1%
EPSS
No
On KEV
Description
The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Cosminexus Application Server · Hitachi
6; 6 · source: NVD
CC
Cosminexus Collaboration Portal · Hitachi
All versions, or not specified · source: NVD
CD
Cosminexus Developer · Hitachi
6; 6; 6 · source: NVD
CE
Cosminexus Erp Integrator · Hitachi
All versions, or not specified · source: NVD
CO
Cosminexus Opentp1 Web Front-end Set · Hitachi
All versions, or not specified · source: NVD
EF
Electronic Form Workflow · Hitachi
All versions, or not specified · source: NVD
GC
Groupmax Collaboration Portal · Hitachi
All versions, or not specified · source: NVD
UA
Ucosminexus Application Server · Hitachi
All versions, or not specified · source: NVD
UC
Ucosminexus Collaboration Portal · Hitachi
All versions, or not specified · source: NVD
UD
Ucosminexus Developer · Hitachi
All versions, or not specified · source: NVD
UE
Ucosminexus Erp Integrator · Hitachi
All versions, or not specified · source: NVD
UO
Ucosminexus Opentp1 Web Front-end Set · Hitachi
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4124
osvdb.org
http://osvdb.org/37852
Vendor Advisory
http://secunia.com/advisories/26250
Patch
http://www.hitachi-support.com/security_e/vuls_e/HS07-024_e/index-e.html
www.securityfocus.com
http://www.securityfocus.com/bid/25145
www.vupen.com
http://www.vupen.com/english/advisories/2007/2725
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/35706
More from Cosminexus Application Server
–
CVE-2009-4776
Buffer overflow in Hitachi Cosminexus V4 through V8, Processing Kit for XML, and Developer's Kit for Java, as used in products such as uCosminexus, Electronic Form Workflow,…
–
CVE-2007-3794
Buffer overflow in Hitachi Cosminexus V4 through V7, Processing Kit for XML before 20070511, Developer's Kit for Java before 20070312, and third-party products that use this…
–
CVE-2007-3626
Unspecified vulnerability in the ADM daemon in Hitachi TPBroker before 20070706 allows remote attackers to cause a denial of service (daemon crash) via a certain request
–
CVE-2007-0514
Multiple cross-site scripting (XSS) vulnerabilities in multiple Hitachi Web Server, uCosminexus, and Cosminexus products before 20070124 allow remote attackers to inject arbitrary…
–
CVE-2005-3164
The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a…