Elcom CommunityManager.NET Session Cookie Authentication Bypass Vulnerability

Bugtraq ID:	45499
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 20 2010 12:00AM
Updated:	Dec 20 2010 12:00AM
Credit:	Sense of Security
Vulnerable:	Elcom Technology CommunityManager.NET 6.7
Not Vulnerable:

Elcom CommunityManager.NET Session Cookie Authentication Bypass Vulnerability

Elcom CommunityManager.NET is prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to gain unauthorized access to the affected application.

CommunityManager.NET 6.7 is vulnerable; other versions may also be affected.

Elcom CommunityManager.NET Session Cookie Authentication Bypass Vulnerability

Attackers can use a browser to exploit this issue.

Elcom CommunityManager.NET Session Cookie Authentication Bypass Vulnerability

Solution:
Reports indicate that updates are available; Symantec has not verified this. Please see the references for more information.

Elcom CommunityManager.NET Session Cookie Authentication Bypass Vulnerability

References:

• CommunityManager.NET Homepage (Elcon Technology)
  
• Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-1 (Sense of Security)