CVE-2007-4124
Summary
| CVE | CVE-2007-4124 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2007-08-01 16:17:00 UTC |
| Updated | 2017-07-29 01:32:00 UTC |
| Description | The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges. |
Risk And Classification
Problem Types: NVD-CWE-Other
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Hitachi | Cosminexus Application Server | 6 | All | enterprise | All |
| Application | Hitachi | Cosminexus Application Server | 6 | All | standard | All |
| Application | Hitachi | Cosminexus Application Server | 6 | All | enterprise | All |
| Application | Hitachi | Cosminexus Application Server | 6 | All | standard | All |
| Application | Hitachi | Cosminexus Collaboration Portal | All | All | All | All |
| Application | Hitachi | Cosminexus Collaboration Portal | All | All | All | All |
| Application | Hitachi | Cosminexus Developer | 6 | All | light | All |
| Application | Hitachi | Cosminexus Developer | 6 | All | professional | All |
| Application | Hitachi | Cosminexus Developer | 6 | All | standard | All |
| Application | Hitachi | Cosminexus Developer | 6 | All | light | All |
| Application | Hitachi | Cosminexus Developer | 6 | All | professional | All |
| Application | Hitachi | Cosminexus Developer | 6 | All | standard | All |
| Application | Hitachi | Cosminexus Erp Integrator | All | All | All | All |
| Application | Hitachi | Cosminexus Erp Integrator | All | All | All | All |
| Application | Hitachi | Cosminexus Opentp1 Web Front-end Set | All | All | All | All |
| Application | Hitachi | Cosminexus Opentp1 Web Front-end Set | All | All | All | All |
| Application | Hitachi | Electronic Form Workflow | All | All | developer_client_set | All |
| Application | Hitachi | Electronic Form Workflow | All | All | professional_library_set | All |
| Application | Hitachi | Electronic Form Workflow | All | All | standard_set | All |
| Application | Hitachi | Electronic Form Workflow | All | All | developer_client_set | All |
| Application | Hitachi | Electronic Form Workflow | All | All | professional_library_set | All |
| Application | Hitachi | Electronic Form Workflow | All | All | standard_set | All |
| Application | Hitachi | Groupmax Collaboration Portal | All | All | server | All |
| Application | Hitachi | Groupmax Collaboration Portal | All | All | server | All |
| Application | Hitachi | Ucosminexus Application Server | All | All | enterprise | All |
| Application | Hitachi | Ucosminexus Application Server | All | All | standard | All |
| Application | Hitachi | Ucosminexus Application Server | All | All | enterprise | All |
| Application | Hitachi | Ucosminexus Application Server | All | All | standard | All |
| Application | Hitachi | Ucosminexus Collaboration Portal | All | All | server | All |
| Application | Hitachi | Ucosminexus Collaboration Portal | All | All | server | All |
| Application | Hitachi | Ucosminexus Developer | All | All | light | All |
| Application | Hitachi | Ucosminexus Developer | All | All | professional | All |
| Application | Hitachi | Ucosminexus Developer | All | All | standard | All |
| Application | Hitachi | Ucosminexus Developer | All | All | light | All |
| Application | Hitachi | Ucosminexus Developer | All | All | professional | All |
| Application | Hitachi | Ucosminexus Developer | All | All | standard | All |
| Application | Hitachi | Ucosminexus Erp Integrator | All | All | All | All |
| Application | Hitachi | Ucosminexus Erp Integrator | All | All | All | All |
| Application | Hitachi | Ucosminexus Opentp1 Web Front-end Set | All | All | All | All |
| Application | Hitachi | Ucosminexus Opentp1 Web Front-end Set | All | All | All | All |
| Application | Hitachi | Ucosminexus Service Architect | All | All | All | All |
| Application | Hitachi | Ucosminexus Service Architect | All | All | All | All |
| Application | Hitachi | Ucosminexus Service Platform | All | All | All | All |
| Application | Hitachi | Ucosminexus Service Platform | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM X-Force Exchange | XF | exchange.xforce.ibmcloud.com | |
| Problem about Handling Session Data when Using the Session Failover Function in uCosminexus Application Server: Software Vulnerability Information: Software: Hitachi | CONFIRM | www.hitachi-support.com | Patch, Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | VUPEN | www.vupen.com | |
| Hitachi Products Cosminexus Component Container Improper Session Data Handling - Advisories - Secunia | SECUNIA | secunia.com | Vendor Advisory |
| 37852 | OSVDB | osvdb.org | |
| Hitachi uCosminexus Application Server Session Failover User Data Leak Vulnerability | BID | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.