1. Home
  2. CVE Database
  3. CVE-2010-3852
MEDIUM · 6.4

CVE-2010-3852

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authent...

Vulnerability Description

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.

CVSS Score

6.4

MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N
Confidentiality
PARTIAL
Integrity
PARTIAL
Availability
NONE

Affected Products

VendorProductVersions
RedhatLuci<= 0.22.4
RedhatCongaAll versions

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2010-3852?

CVE-2010-3852 is a vulnerability with a CVSS score of 6.4 (MEDIUM). The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authent...

How severe is CVE-2010-3852?

CVE-2010-3852 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2010-3852?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Luci, Redhat Conga.