CVE Vulnerabilities

CVE-2014-0906

Published: May 26, 2014 | Modified: Aug 29, 2017
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a (1) expired or (2) invalidated cookie.

Affected Software

Name Vendor Start Version End Version
Sametime Ibm 8.0.0.0 (including) 8.0.0.0 (including)
Sametime Ibm 8.0.1.0 (including) 8.0.1.0 (including)
Sametime Ibm 8.0.1.1 (including) 8.0.1.1 (including)
Sametime Ibm 8.0.2.0 (including) 8.0.2.0 (including)
Sametime Ibm 8.0.2.1 (including) 8.0.2.1 (including)
Sametime Ibm 8.5.0.0 (including) 8.5.0.0 (including)
Sametime Ibm 8.5.1.0 (including) 8.5.1.0 (including)
Sametime Ibm 8.5.1.1 (including) 8.5.1.1 (including)
Sametime Ibm 8.5.2.0 (including) 8.5.2.0 (including)
Sametime Ibm 8.5.2.1 (including) 8.5.2.1 (including)
Sametime Ibm 9.0.0.0 (including) 9.0.0.0 (including)

References