medium5.1Public exploit code
CVE-2014-1219
CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sess…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- CA 2E Web Option 8.1.2 - Authentication Bypass2014-02-13 · webapps · multiple
Impact
CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to web2edoc/close.htm.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Broadcom | 2e Web Option | Version r8.1.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/
- http://www.securityfocus.com/bid/65537
- http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/
- http://www.securityfocus.com/bid/65537