{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-09-19T00:00:00", "descriptions": [{"lang": "en", "value": "Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "55618", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/55618"}, {"name": "RHSA-2012:1278", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"name": "RHSA-2012:1281", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"name": "cumin-redhat-session-hijacking(78776)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78776"}, {"tags": ["x_refsource_MISC"], "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832151"}, {"name": "50660", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/50660"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:42:32.499Z"}, "title": "CVE Program Container", "references": [{"name": "55618", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/55618"}, {"name": "RHSA-2012:1278", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"name": "RHSA-2012:1281", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"name": "cumin-redhat-session-hijacking(78776)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78776"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832151"}, {"name": "50660", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/50660"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2735", "datePublished": "2012-09-28T17:00:00", "dateReserved": "2012-05-14T00:00:00", "dateUpdated": "2024-08-06T19:42:32.499Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB8CE3E6-C78F-4363-B731-A7981046EE5B", "versionEndIncluding": "0.1.5192-4", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:*", "matchCriteriaId": "B33C6617-24FB-4C96-A786-D26B074B0569", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:*", "matchCriteriaId": "D6CF3F68-713E-48E8-8D37-4AE443AF87FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:*", "matchCriteriaId": "8BDF4FB8-5ECF-4A2F-8066-8C362574B55F", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:*", "matchCriteriaId": "6ADC326A-3CE8-4710-870B-BF540CCB4A5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:*", "matchCriteriaId": "FFB4776E-178C-4488-9C98-98859576E343", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:*", "matchCriteriaId": "77B6E427-B880-48EB-8139-2F54381539BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5033-1:*:*:*:*:*:*:*", "matchCriteriaId": "9EABF881-94BA-4E76-8EDB-29A4DB7F68B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5037-1:*:*:*:*:*:*:*", "matchCriteriaId": "476B4482-38CB-46FB-B05D-CBBCDA87B739", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5054-1:*:*:*:*:*:*:*", "matchCriteriaId": "F49E39C4-D9D4-44D0-9F24-2DB3EB1E4457", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5068-1:*:*:*:*:*:*:*", "matchCriteriaId": "75A69413-E0B0-4528-8C42-898866BD3B9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5092-1:*:*:*:*:*:*:*", "matchCriteriaId": "00B69A8C-A652-4CBB-80B1-171630C7420E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:*", "matchCriteriaId": "11E7AFB1-7864-47D4-AD75-9B9950BE7BBB", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5105-1:*:*:*:*:*:*:*", "matchCriteriaId": "B9C553FD-1ED7-436A-B4A7-309C79CB7793", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-1:*:*:*:*:*:*:*", "matchCriteriaId": "4CBBA885-F992-464D-9DF4-047F824FC02B", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-2:*:*:*:*:*:*:*", "matchCriteriaId": "D313A509-35AE-4EA3-9EDC-20CA98293D99", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-3:*:*:*:*:*:*:*", "matchCriteriaId": "B84531E0-D82D-43AE-A708-B12C34984B70", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-4:*:*:*:*:*:*:*", "matchCriteriaId": "9106FF80-627C-40E1-80E1-E574EB9A6B8C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5137-5:*:*:*:*:*:*:*", "matchCriteriaId": "F46220E7-B924-49D4-B866-3EA6B52F4D45", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:*", "matchCriteriaId": "CACA1231-8272-40A9-B7B3-0141E0F1D7A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "C60FA8B1-1802-4522-A088-22171DCF7A93", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie."}, {"lang": "es", "value": "Vulnerabilidad de fijaci\u00f3n de sesi\u00f3n en Cumin antes de v0.1.5444, tal y como se usa en Red Hat Enterprise Messaging, Realtime, y Grid (MRG) v2.0 permite a atacantes remotos secuestrar sesiones web a trav\u00e9s de una cookie de sesi\u00f3n modificada a mano."}], "evaluatorComment": "Per: http://cwe.mitre.org/data/definitions/384.html 'CWE-384: Session Fixation'", "evaluatorImpact": "Per: http://rhn.redhat.com/errata/RHSA-2012-1278.html\r\n\r\n\" An authenticated user able to\r\npre-set the Cumin session cookie in a victim's browser could possibly use\r\nthis flaw to steal the victim's session after they log into Cumin.\"", "id": "CVE-2012-2735", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-09-28T17:55:01.070", "references": [{"source": "secalert@redhat.com", "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832151"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/50660"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/55618"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78776"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=832151"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/50660"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/55618"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78776"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "This issue was discovered by Florian Weimer (Red Hat Product Security Team).", "affected_release": [{"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "condor-0:7.6.5-0.22.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "condor-wallaby-0:4.1.3-1.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "condor-wallaby-base-db-0:1.23-1.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "cumin-0:0.1.5444-3.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "sesame-0:1.0-4.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "wallaby-0:0.12.5-10.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "condor-0:7.6.5-0.22.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "condor-wallaby-0:4.1.3-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "condor-wallaby-base-db-0:1.23-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "cumin-0:0.1.5444-3.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "deltacloud-core-0:0.5.0-10.el6_2", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "libdeltacloud-0:0.9-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-daemons-0:1.1.4-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-eventmachine-0:0.12.10-7.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-fssm-0:0.2.7-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-haml-0:3.1.2-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-hpricot-0:0.8.4-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-json-0:1.4.6-10.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-maruku-0:0.6.0-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-mime-types-0:1.16-4.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-mocha-0:0.9.7-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-net-ssh-0:2.0.23-6.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-nokogiri-0:1.5.0-0.8.beta4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rack-1:1.3.0-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rack-accept-0:0.4.3-6.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rack-test-0:0.6.1-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rake-0:0.8.7-2.1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rest-client-0:1.6.1-2.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygems-0:1.8.16-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-sass-0:3.1.4-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-sinatra-1:1.2.6-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-syntax-0:1.0.0-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-thin-0:1.2.11-3.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-tilt-0:1.3.2-3.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-yard-0:0.7.2-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "sesame-0:1.0-6.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "wallaby-0:0.12.5-10.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}], "bugzilla": {"description": "cumin: session fixation flaw", "id": "832151", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=832151"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "verified"}, "cwe": "CWE-384", "details": ["Session fixation vulnerability in Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, allows remote attackers to hijack web sessions via a crafted session cookie."], "name": "CVE-2012-2735", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_mrg:1", "fix_state": "Will not fix", "package_name": "cumin", "product_name": "Red Hat Enterprise MRG 1"}], "public_date": "2012-09-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-2735\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-2735"], "threat_severity": "Moderate"}