Vulnerability-Lookup

CERTA-2006-AVI-567

Vulnerability from certfr_avis - Published: - Updated:

None

Description

Une vulnérabilité a été découverte dans Computer Associates CleverPath Portal lorsqu'il est déployé dans un environnement multi-serveur. Un utilisateur s'authentifiant auprès d'un des portails peut récupérer la session d'un utilisateur connecté à un autre portail sur la même machine.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
N/A	N/A	Unicenter Workload Control Center r1 SP4 ;
Liferay	Portal	Unicenter Database Management Portal r11 ;
ESET	Security	eTrust Security Command Center r8 ;
Liferay	Portal	Unicenter Management Portal r11.0.
Liferay	Portal	Unicenter Management Portal r2.0 ;
N/A	N/A	CleverPath Aion BPM r10.1 ;
Liferay	Portal	CleverPath Portal r4.71 ;
ESET	Security	eTrust Security Command Center r1 ;
N/A	N/A	CleverPath Aion BPM r10 ;
N/A	N/A	Unicenter Database Command Center r11.1 ;
Liferay	Portal	CleverPath Portal r4.51 ;
N/A	N/A	CleverPath Aion BPM r10.2 ;
Liferay	Portal	CleverPath Portal r4.7 ;
Liferay	Portal	BrightStor Portal r11.1 ;
N/A	N/A	Unicenter Asset and Portfolio Management r11 ;
N/A	N/A	Unicenter Enterprise Job Manager r1 SP3 ;
Liferay	Portal	Unicenter Management Portal r3.1 ;

References

Title

Publication Time

Tags

Bulletin de sécurité Computer Associates du 19 décembre 2006	None	vendor-advisory
Bulletin de sécurité Computer Associates du 19 décembre 2006 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Unicenter Workload Control Center r1 SP4 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Database Management Portal r11 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "eTrust Security Command Center r8 ;",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Management Portal r11.0.",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Management Portal r2.0 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "CleverPath Aion BPM r10.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "CleverPath Portal r4.71 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "eTrust Security Command Center r1 ;",
      "product": {
        "name": "Security",
        "vendor": {
          "name": "ESET",
          "scada": false
        }
      }
    },
    {
      "description": "CleverPath Aion BPM r10 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Database Command Center r11.1 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "CleverPath Portal r4.51 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "CleverPath Aion BPM r10.2 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "CleverPath Portal r4.7 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "BrightStor Portal r11.1 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Asset and Portfolio Management r11 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Enterprise Job Manager r1 SP3 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Unicenter Management Portal r3.1 ;",
      "product": {
        "name": "Portal",
        "vendor": {
          "name": "Liferay",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Computer Associates CleverPath\nPortal lorsqu\u0027il est d\u00e9ploy\u00e9 dans un environnement multi-serveur. Un\nutilisateur s\u0027authentifiant aupr\u00e8s d\u0027un des portails peut r\u00e9cup\u00e9rer la\nsession d\u0027un utilisateur connect\u00e9 \u00e0 un autre portail sur la m\u00eame\nmachine.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-6641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6641"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Computer Associates du 19 d\u00e9cembre    2006 :",
      "url": "http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp"
    }
  ],
  "reference": "CERTA-2006-AVI-567",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-12-21T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": null,
  "title": "Vuln\u00e9rabilit\u00e9 dans Computer Associates CleverPath",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Computer Associates du 19 d\u00e9cembre 2006",
      "url": null
    }
  ]
}

CVE-2006-6641 (GCVE-0-2006-6641)

Vulnerability from cvelistv5 – Published: 2006-12-20 00:00 – Updated: 2024-08-07 20:33

Summary

Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001_179_060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Command Center r1 and r8, and Unicenter, does not properly handle when multiple Portal servers are started at the same time and share the same data store, which might cause a Portal user to inherit the session and credentials of a user who is on another Portal server.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root Scorecard

References

8 references

URL	Tags
http://www.securityfocus.com/bid/21681	vdb-entryx_refsource_BID
http://www.vupen.com/english/advisories/2006/5091	vdb-entryx_refsource_VUPEN
http://supportconnectw.ca.com/public/ca_common_do…	x_refsource_CONFIRM
http://www.securityfocus.com/archive/1/455041/100…	mailing-listx_refsource_BUGTRAQ
http://www.osvdb.org/30854	vdb-entryx_refsource_OSVDB
http://securitytracker.com/id?1017429	vdb-entryx_refsource_SECTRACK
http://www3.ca.com/securityadvisor/vulninfo/vuln.…	x_refsource_CONFIRM
http://secunia.com/advisories/23426	third-party-advisoryx_refsource_SECUNIA

Date Public

2006-12-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:33:59.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "21681",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21681"
          },
          {
            "name": "ADV-2006-5091",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/5091"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp"
          },
          {
            "name": "20061221 [CAID 34876]: CA CleverPath Portal Session Inheritance Vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/455041/100/0/threaded"
          },
          {
            "name": "30854",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/30854"
          },
          {
            "name": "1017429",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017429"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34876"
          },
          {
            "name": "23426",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23426"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-12-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001_179_060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Command Center r1 and r8, and Unicenter, does not properly handle when multiple Portal servers are started at the same time and share the same data store, which might cause a Portal user to inherit the session and credentials of a user who is on another Portal server."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "21681",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21681"
        },
        {
          "name": "ADV-2006-5091",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/5091"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp"
        },
        {
          "name": "20061221 [CAID 34876]: CA CleverPath Portal Session Inheritance Vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/455041/100/0/threaded"
        },
        {
          "name": "30854",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/30854"
        },
        {
          "name": "1017429",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017429"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34876"
        },
        {
          "name": "23426",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23426"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6641",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001_179_060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Command Center r1 and r8, and Unicenter, does not properly handle when multiple Portal servers are started at the same time and share the same data store, which might cause a Portal user to inherit the session and credentials of a user who is on another Portal server."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "21681",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21681"
            },
            {
              "name": "ADV-2006-5091",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/5091"
            },
            {
              "name": "http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp",
              "refsource": "CONFIRM",
              "url": "http://supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp"
            },
            {
              "name": "20061221 [CAID 34876]: CA CleverPath Portal Session Inheritance Vulnerability",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/455041/100/0/threaded"
            },
            {
              "name": "30854",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/30854"
            },
            {
              "name": "1017429",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017429"
            },
            {
              "name": "http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34876",
              "refsource": "CONFIRM",
              "url": "http://www3.ca.com/securityadvisor/vulninfo/vuln.aspx?id=34876"
            },
            {
              "name": "23426",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23426"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6641",
    "datePublished": "2006-12-20T00:00:00.000Z",
    "dateReserved": "2006-12-19T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:33:59.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted