CVE-2013-4725 — MEDIUM (5.0)

Vulnerability Description

DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Ddsn	Cm3 Acora Content Management System	5.5.0\/1b-p1

Related Weaknesses (CWE)

CWE-200

References

http://osvdb.org/96664
http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txtVendor Advisory
http://osvdb.org/96664
http://www.digitalsec.net/stuff/explt+advs/CM3.AcoraCMS.v6.txtVendor Advisory

FAQ

What is CVE-2013-4725?

CVE-2013-4725 is a vulnerability with a CVSS score of 5.0 (MEDIUM). DDSN Interactive cm3 Acora CMS 6.0.6/1a, 6.0.2/1a, 5.5.7/12b, 5.5.0/1b-p1, and possibly other versions, does not set the secure flag for an unspecified cookie in an https session, which makes it easie...

How severe is CVE-2013-4725?

CVE-2013-4725 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2013-4725?

Check the references section above for vendor advisories and patch information. Affected products include: Ddsn Cm3 Acora Content Management System.