1. CVE-Search
  2. CVE-2007-4124
ID CVE-2007-4124
Summary The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
References
Vulnerable Configurations
  • cpe:2.3:a:hitachi:cosminexus_application_server:6:*:enterprise:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_application_server:6:*:enterprise:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_application_server:6:*:standard:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_application_server:6:*:standard:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_collaboration_portal:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_collaboration_portal:*:*:*:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_developer:6:*:light:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_developer:6:*:light:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_developer:6:*:professional:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_developer:6:*:professional:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_developer:6:*:standard:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_developer:6:*:standard:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_erp_integrator:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_erp_integrator:*:*:*:*:*:*:*:*
  • cpe:2.3:a:hitachi:cosminexus_opentp1_web_front-end_set:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:cosminexus_opentp1_web_front-end_set:*:*:*:*:*:*:*:*
  • cpe:2.3:a:hitachi:electronic_form_workflow:*:*:developer_client_set:*:*:*:*:*
    cpe:2.3:a:hitachi:electronic_form_workflow:*:*:developer_client_set:*:*:*:*:*
  • cpe:2.3:a:hitachi:electronic_form_workflow:*:*:professional_library_set:*:*:*:*:*
    cpe:2.3:a:hitachi:electronic_form_workflow:*:*:professional_library_set:*:*:*:*:*
  • cpe:2.3:a:hitachi:electronic_form_workflow:*:*:standard_set:*:*:*:*:*
    cpe:2.3:a:hitachi:electronic_form_workflow:*:*:standard_set:*:*:*:*:*
  • cpe:2.3:a:hitachi:groupmax_collaboration_portal:*:*:server:*:*:*:*:*
    cpe:2.3:a:hitachi:groupmax_collaboration_portal:*:*:server:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_application_server:*:*:enterprise:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_application_server:*:*:enterprise:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_application_server:*:*:standard:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_application_server:*:*:standard:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_collaboration_portal:*:*:server:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_collaboration_portal:*:*:server:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_developer:*:*:light:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_developer:*:*:light:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_developer:*:*:professional:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_developer:*:*:professional:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_developer:*:*:standard:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_developer:*:*:standard:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_erp_integrator:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_erp_integrator:*:*:*:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_opentp1_web_front-end_set:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_opentp1_web_front-end_set:*:*:*:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_service_architect:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_service_architect:*:*:*:*:*:*:*:*
  • cpe:2.3:a:hitachi:ucosminexus_service_platform:*:*:*:*:*:*:*:*
    cpe:2.3:a:hitachi:ucosminexus_service_platform:*:*:*:*:*:*:*:*
CVSS
Base: 4.9 (as of 29-07-2017 - 01:32)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM SINGLE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL NONE
cvss-vector via4 AV:N/AC:M/Au:S/C:P/I:P/A:N
refmap via4
bid 25145
confirm http://www.hitachi-support.com/security_e/vuls_e/HS07-024_e/index-e.html
osvdb 37852
secunia 26250
vupen ADV-2007-2725
xf hitachi-container-session-hijacking(35706)
Last major update 29-07-2017 - 01:32
Published 01-08-2007 - 16:17
Last modified 29-07-2017 - 01:32
Back to Top