Vulnerability Name:

CVE-2007-4124 (CCN-35706)

Assigned:2007-07-31
Published:2007-07-31
Updated:2017-07-29
Summary:The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
CVSS v3 Severity:4.6 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.9 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N)
3.6 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
4.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P)
3.4 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2007-4124

Source: OSVDB
Type: UNKNOWN
37852

Source: CCN
Type: SA26250
Hitachi Products Cosminexus Component Container Improper Session Data Handling

Source: SECUNIA
Type: Vendor Advisory
26250

Source: CCN
Type: Hitachi Security Vulnerability Information HS07-024
Problem about Handling Session Data when Using the Session Failover Function in uCosminexus Application Server

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.hitachi-support.com/security_e/vuls_e/HS07-024_e/index-e.html

Source: CCN
Type: OSVDB ID: 37852
Hitachi Multiple Products Cosminexus Component Container Session Data Handling Privilege Escalation

Source: BID
Type: UNKNOWN
25145

Source: CCN
Type: BID-25145
Hitachi uCosminexus Application Server Session Failover User Data Leak Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2007-2725

Source: XF
Type: UNKNOWN
hitachi-container-session-hijacking(35706)

Source: XF
Type: UNKNOWN
hitachi-container-session-hijacking(35706)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:hitachi:cosminexus_application_server:6:*:enterprise:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_application_server:6:*:standard:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_collaboration_portal:*:*:*:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_developer:6:*:light:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_developer:6:*:professional:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_developer:6:*:standard:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_erp_integrator:*:*:*:*:*:*:*:*
  • OR cpe:/a:hitachi:cosminexus_opentp1_web_front-end_set:*:*:*:*:*:*:*:*
  • OR cpe:/a:hitachi:electronic_form_workflow:*:*:developer_client_set:*:*:*:*:*
  • OR cpe:/a:hitachi:electronic_form_workflow:*:*:professional_library_set:*:*:*:*:*
  • OR cpe:/a:hitachi:electronic_form_workflow:*:*:standard_set:*:*:*:*:*
  • OR cpe:/a:hitachi:groupmax_collaboration_portal:*:*:server:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_application_server:*:*:enterprise:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_application_server:*:*:standard:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_collaboration_portal:*:*:server:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_developer:*:*:light:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_developer:*:*:professional:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_developer:*:*:standard:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_erp_integrator:*:*:*:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_opentp1_web_front-end_set:*:*:*:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_service_architect:*:*:*:*:*:*:*:*
  • OR cpe:/a:hitachi:ucosminexus_service_platform:*:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    hitachi cosminexus application server 6
    hitachi cosminexus application server 6
    hitachi cosminexus collaboration portal *
    hitachi cosminexus developer 6
    hitachi cosminexus developer 6
    hitachi cosminexus developer 6
    hitachi cosminexus erp integrator *
    hitachi cosminexus opentp1 web front-end set *
    hitachi electronic form workflow *
    hitachi electronic form workflow *
    hitachi electronic form workflow *
    hitachi groupmax collaboration portal *
    hitachi ucosminexus application server *
    hitachi ucosminexus application server *
    hitachi ucosminexus collaboration portal *
    hitachi ucosminexus developer *
    hitachi ucosminexus developer *
    hitachi ucosminexus developer *
    hitachi ucosminexus erp integrator *
    hitachi ucosminexus opentp1 web front-end set *
    hitachi ucosminexus service architect *
    hitachi ucosminexus service platform *