high7.5
CVE-2020-11728
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60.
Impact
An issue was discovered in DAViCal Andrew's Web Libraries (AWL) through 0.60. Session management does not use a sufficiently hard-to-guess session key. Anyone who can guess the microsecond time (and the incrementing session_id) can impersonate a session.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Davical | Andrew\'S Web Libraries | through 0.60 |
| Debian | Debian Linux | Versions 8.0, 9.0, 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650
- https://gitlab.com/davical-project/awl/-/issues/19
- https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html
- https://usn.ubuntu.com/4539-1/
- https://www.debian.org/security/2020/dsa-4660
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956650
- https://gitlab.com/davical-project/awl/-/issues/19
- https://lists.debian.org/debian-lts-announce/2020/04/msg00011.html
- https://usn.ubuntu.com/4539-1/
- https://www.debian.org/security/2020/dsa-4660