Unscored severity · published Nov 6, 2010
CVE-2010-3852
The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to…
–
CVSS
2%
EPSS
No
On KEV
Description
The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LU
Luci · Redhat
through 0.22.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3852
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3852
git.fedorahosted.org
http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html
osvdb.org
http://osvdb.org/69015
Vendor Advisory
http://secunia.com/advisories/42113
More from Luci
–
CVE-2011-0720
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create…