Session fixation

2016-07-0801:59:00

PRIOn knowledge base

www.prio-n.com

6.6 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server’s identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors.

CPENameOperatorVersion
urbancode_deployeq6.1.1.2
urbancode_deployeq6.2.0.0
urbancode_deployeq6.0.1.8
urbancode_deployeq6.2.0.2
urbancode_deployeq6.1.0.4
urbancode_deployeq6.0.1.9
urbancode_deployeq6.0.1.1
urbancode_deployeq6.0.1.11
urbancode_deployeq6.0.1.7
urbancode_deployeq6.0.1.3

Name	Operator	Version
urbancode_deploy	eq	6.1.1.2
urbancode_deploy	eq	6.2.0.0
urbancode_deploy	eq	6.0.1.8
urbancode_deploy	eq	6.2.0.2
urbancode_deploy	eq	6.1.0.4
urbancode_deploy	eq	6.0.1.9
urbancode_deploy	eq	6.0.1.1
urbancode_deploy	eq	6.0.1.11
urbancode_deploy	eq	6.0.1.7
urbancode_deploy	eq	6.0.1.3