CVE-2010-5067 — MEDIUM (6.8)

Vulnerability Description

Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie.

CVSS Score

6.8

MEDIUM

AV:N/AC:M/Au:N/C:P/I:P/A:P

Confidentiality

PARTIAL

Integrity

PARTIAL

Availability

PARTIAL

Affected Products

Vendor	Product	Versions
Vwar	Virtual War	1.6.1

Related Weaknesses (CWE)

CWE-255

References

http://dmcdonald.net/vwar.txtExploit
http://seclists.org/fulldisclosure/2010/Aug/235Exploit
http://dmcdonald.net/vwar.txtExploit
http://seclists.org/fulldisclosure/2010/Aug/235Exploit

FAQ

What is CVE-2010-5067?

CVE-2010-5067 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access fo...

How severe is CVE-2010-5067?

CVE-2010-5067 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2010-5067?

Check the references section above for vendor advisories and patch information. Affected products include: Vwar Virtual War.