CVEvulnerability
CVE-2009-2165
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2009-06-22
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Description
SerendipityNZ (aka SimpleBoxes) Serene Bach 2.20R and earlier, and 3.00 beta023 and earlier 3.x versions, uses a predictable session id, which makes it easier for remote attackers to hijack sessions via a modified id.
Affected configurations
• serendipitynz serene bach (<= 2.20r)
• serendipitynz serene bach 1.18r
• serendipitynz serene bach 1.19r
• serendipitynz serene bach 2.05r
• serendipitynz serene bach 2.08d
• serendipitynz serene bach 2.09r
• serendipitynz serene bach 3.00
References
- http://jvn.jp/en/jp/JVN20689557/index.html jvn.jp
- http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000035.html jvndb.jvn.jp
- http://secunia.com/advisories/35335 Vendor Advisory
- http://serenebach.net/log/sb221R.html Vendor Advisory
- http://www.securityfocus.com/bid/35254 www.securityfocus.com
- http://jvn.jp/en/jp/JVN20689557/index.html jvn.jp
- http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000035.html jvndb.jvn.jp
- http://secunia.com/advisories/35335 Vendor Advisory
- http://serenebach.net/log/sb221R.html Vendor Advisory
- http://www.securityfocus.com/bid/35254 www.securityfocus.com