CVE Vulnerabilities

CVE-2013-2049

Session Fixation

Published: May 01, 2018 | Modified: Jun 13, 2018
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
5 IMPORTANT
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V3
Ubuntu

Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.

Weakness

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Affected Software

Name Vendor Start Version End Version
Cloudforms_management_engine Redhat 2.0 (including) 2.0 (including)
CloudForms Management Engine 5.x RedHat cfme-0:5.2.0.37-1.el6cf *
CloudForms Management Engine 5.x RedHat cfme-vnc-plugin-0:1.0.0-2.el6cf *
CloudForms Management Engine 5.x RedHat libdnet-0:1.12-11.el6cf *
CloudForms Management Engine 5.x RedHat lshw-0:B.02.16-4.el6cf *
CloudForms Management Engine 5.x RedHat netapp-manageability-sdk-0:4.0P1-3.el6cf *
CloudForms Management Engine 5.x RedHat open-vm-tools-0:9.2.3-5.el6cf *
CloudForms Management Engine 5.x RedHat postgresql92-0:1-12.el6 *
CloudForms Management Engine 5.x RedHat postgresql92-postgresql-0:9.2.4-7.el6 *
CloudForms Management Engine 5.x RedHat prince-0:9.0r2-3.el6cf *
CloudForms Management Engine 5.x RedHat pyliblzma-0:0.5.3-7.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-0:1-11.el6 *
CloudForms Management Engine 5.x RedHat ruby193-libyaml-0:0.1.4-5.el6 *
CloudForms Management Engine 5.x RedHat ruby193-ruby-0:1.9.3.448-38.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-actionmailer-1:3.2.13-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-actionpack-1:3.2.13-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-actionwebservice-1:3.1.0-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-activemodel-1:3.2.13-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-activerecord-1:3.2.13-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-activeresource-1:3.2.13-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-activesupport-1:3.2.13-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-acts_as_list-0:0.1.9-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-acts_as_tree-0:0.1.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-addressable-0:2.2.8-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-akami-0:1.2.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-american_date-0:1.0.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ancestry-0:1.2.5-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-arel-0:3.0.2-3.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-arrayfields-0:4.9.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-awesome_print-0:1.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-aws-sdk-0:1.11.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-binary_struct-0:1.0.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-brakeman-0:2.0.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-builder-0:3.0.0-3.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-bullet-0:4.6.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-bundler-0:1.3.5-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-bundler_ext-0:0.3.0-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-capybara-0:2.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-childprocess-0:0.3.9-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-chronic-0:0.3.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-churn-0:0.0.29-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-code_analyzer-0:0.3.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-color-0:1.4.1-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-colored-0:1.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-crack-0:0.3.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-daemons-0:1.1.9-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-dalli-0:2.2.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-default_value_for-0:1.0.7-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-diff-lcs-0:1.1.3-1.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-elif-0:0.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-erubis-0:2.7.0-4.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-eventmachine-0:1.0.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-excon-0:0.25.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ezcrypto-0:0.7-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-facade-0:1.0.5-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-factory_girl-0:4.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-fastercsv-0:1.5.5-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-fattr-0:2.2.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ffi-0:1.3.1-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-flay-0:2.3.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-flog-0:3.2.3-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-fog-0:1.14.0-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-formatador-0:0.2.4-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-gyoku-0:0.4.6-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-haml-0:4.0.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-haml-rails-0:0.4-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-handsoap-0:0.2.5-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-highline-0:1.6.19-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-hike-0:1.2.1-3.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-hirb-0:0.7.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-hmac-0:0.4.0-7.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-hoe-0:2.12.3-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-httparty-0:0.10.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-httpclient-0:2.2.7-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-httpi-0:1.1.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-i18n-0:0.6.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-inifile-0:2.0.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-io-extra-0:1.2.6-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-japgolly-Saikuro-0:1.1.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-journey-0:1.0.4-2.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-json-0:1.8.0-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-json_pure-0:1.8.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-libxml-ruby-0:2.2.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-linux_admin-0:0.5.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-little-plugger-0:1.1.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-log4r-0:1.1.8-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-logging-0:1.6.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-mail-0:2.5.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-main-0:4.7.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-map-0:6.5.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-metric_fu-0:3.0.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-mime-types-0:1.20.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-minitest-0:3.2.0-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-more_core_extensions-0:1.1.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-multi_json-0:1.7.7-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-multi_xml-0:0.5.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-net-http-persistent-0:2.7-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-net-ldap-0:0.2.20110317223538-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-net-ping-0:1.5.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-netrc-0:0.7.7-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-net-scp-0:1.1.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-net-sftp-0:2.0.5-7.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-net-ssh-0:2.6.5-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-nokogiri-0:1.5.6-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-nori-0:1.1.4-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-open4-0:1.3.0-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ovirt_metrics-0:1.0.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-parallel-0:0.5.21-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-pdf-writer-0:1.1.8-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-pg-0:0.12.2-5.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-Platform-0:0.4.0-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-polyglot-0:0.3.3-2.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-princely-0:1.2.6-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-progressbar-0:0.11.0-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-prototype-rails-0:3.2.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-qpid_messaging-0:0.20.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rack-1:1.4.5-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rack-cache-0:1.2-2.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rack-ssl-0:1.3.2-7.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rack-test-0:0.6.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rails-1:3.2.13-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rails_best_practices-0:1.13.8-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-railties-1:3.2.13-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rake-0:10.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rake-compiler-0:0.8.3-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rbovirt-0:0.0.17-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rbvmomi-0:1.2.3-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rdoc-0:3.12.2-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-reek-0:1.3.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ref-0:1.0.0-3.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rest-client-0:1.6.7-5.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-roodi-0:2.2.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rspec-0:2.12.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rspec-core-0:2.12.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rspec-expectations-0:2.12.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rspec-mocks-0:2.12.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rspec-rails-0:2.12.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruby2ruby-0:2.0.6-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rubyforge-0:2.0.4-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruby-graphviz-0:1.0.9-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruby_parser-0:3.1.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruby-plsql-0:0.4.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruby-prof-0:0.13.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruby-progressbar-0:0.0.10-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rubyrep-0:1.2.0-4.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rubywbem-0:0.1.0-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rubyzip-0:0.9.5-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rufus-lru-0:1.0.5-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-rufus-scheduler-0:2.0.19-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ruport-0:1.7.0-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-sass-0:3.1.20-3.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-savon-0:1.1.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-selenium-webdriver-0:2.32.1-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-sexp_processor-0:4.2.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-shindo-0:0.3.4-7.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-shoulda-matchers-0:1.0.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-simplecov-0:0.7.1-6.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-simplecov-html-0:0.7.1-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-simplecov-rcov-0:0.2.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-simplecov-rcov-text-0:0.0.2-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-simple-rss-0:1.2.3-8.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-slim-0:1.3.9-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-snmp-0:1.1.0-6.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-soap4r-0:1.6.0-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-sprockets-0:2.4.5-2.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-sqlite3-0:1.3.6-2.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-state_machine-0:1.1.2-8.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-syntax-0:1.0.0-8.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-temple-0:0.6.5-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-terminal-table-0:1.4.5-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-test-spec-0:0.10.0-7.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-test-unit-0:2.4.5-5.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-therubyracer-0:0.11.0-0.6.beta5.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-thin-0:1.3.1-5.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-thor-0:0.18.1-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-tilt-0:1.3.3-10.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-timecop-0:0.5.3-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-transaction-simple-0:1.4.0-5.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-treetop-0:1.4.10-6.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-trollop-0:1.16.2-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-tzinfo-0:0.3.33-2.el6 *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-uniform_notifier-0:1.2.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-uuidtools-0:2.1.3-3.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-vcr-0:2.4.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-wasabi-0:2.5.1-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-webmock-0:1.11.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-websocket-0:1.0.7-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-xml-simple-0:1.0.12-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-xpath-0:2.0.0-1.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-rubygem-ziya-0:2.3.0-2.el6cf *
CloudForms Management Engine 5.x RedHat ruby193-v8-1:3.14.5.10-1.1.el6 *

Extended Description

Such a scenario is commonly observed when:

Potential Mitigations

References