Unscored severity · published Mar 31, 2014
CVE-2013-7347
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie
–
CVSS
0.3%
EPSS
No
On KEV
Description
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Conga · Redhat
All versions, or not specified · source: NVD
EL
Enterprise Linux · Redhat
5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-7347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-7347
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-0128.html
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=607179
More from Conga
–
CVE-2014-3521
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL
–
CVE-2013-6496
Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5)…
–
CVE-2012-3359
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this…
–
CVE-2011-0720
Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create…
–
CVE-2007-4136
The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections