CVE-2014-2509: Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote attackers to hijack web sessions via a…

Unscored severity · published Jul 1, 2014

CVE-2014-2509

Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote attackers to hijack web sessions via a…

–

CVSS

1.6%

EPSS

On KEV

Description

Session fixation vulnerability in the Report Advisor (RA) component in EMC Network Configuration Manager (NCM) before 9.3 allows remote attackers to hijack web sessions via a session cookie.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 75% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Smarts Network Configuration Manager · Emc

through 9.2; 9.1 · source: NVD

Affected product

Smarts Network Configuration Manager

Emc

All Smarts Network Configuration Manager CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2014-2509

CVE.org

https://www.cve.org/CVERecord?id=CVE-2014-2509

archives.neohapsis.com

http://archives.neohapsis.com/archives/bugtraq/2014-06/0168.html

packetstormsecurity.com

http://packetstormsecurity.com/files/127301/EMC-Network-Configuration-Manager-NCM-Session-Fixation.html

secunia.com

http://secunia.com/advisories/59423

www.securityfocus.com

http://www.securityfocus.com/archive/1/533077/100/0/threaded

www.securitytracker.com

http://www.securitytracker.com/id/1030494

More from Smarts Network Configuration Manager

9.8

CVE-2017-2768

EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager…

9.8

CVE-2017-2767

EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC Network Configuration Manager…

6.1

CVE-2017-8017

EMC Network Configuration Manager (NCM) 9.3.x, 9.4.0.x, 9.4.1.x, and 9.4.2.x is affected by a reflected cross-site scripting Vulnerability that could potentially be exploited by…

–

CVE-2013-2717

Multiple unspecified vulnerabilities in the System Management (aka SysAdmin) Console in EMC Smarts Network Configuration Manager (NCM) through 9.2 have unknown impact and attack…

–

CVE-2013-0935

EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls, which allows remote attackers to execute arbitrary code…