CVEvulnerability

CVE-2019-8978

8.1 HIGH Published 2019-05-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-05-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-287, CWE-362

Description

An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim's session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim's UDCID, which in the case tested is the institutional ID. During a login attempt by a victim, the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim.

Affected configurations

• ellucian banner enterprise identity services 8.3 • ellucian banner enterprise identity services 8.3.1 • ellucian banner enterprise identity services 8.3.2 • ellucian banner enterprise identity services 8.4 • ellucian banner web tailor 8.8.3 • ellucian banner web tailor 8.8.4 • ellucian banner web tailor 8.9

Related

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References