high7.5
CVE-2020-26515
An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4.
Impact
An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Intland | Codebeamer | from 10.0.0 before 10.1.0 Version 10.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://intland.com/codebeamer/application-lifecycle-management/
- https://www.compass-security.com/fileadmin/Research/Advisories/2021-09_CSNC-2020-010-codebeamer_ALM_Insecure-RememberMe.txt
- https://intland.com/codebeamer/application-lifecycle-management/
- https://www.compass-security.com/fileadmin/Research/Advisories/2021-09_CSNC-2020-010-codebeamer_ALM_Insecure-RememberMe.txt