CVE-2000-0397: Medium severity Seattle Lab Software Emurl vulnerability
The EMURL web-based email account software encodes predictable identifiers in user session URLs, which allows a remote attacker to access a user's email account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Stop encoding session identifiers in user-facing URLs. Do not place session identifiers or account-identifying tokens in URLs; transmit session identifiers via secure cookies instead.
Seattle Lab Software Emurl session_id_in_url = false - Configuration
Generate session identifiers using a cryptographically secure random generator with sufficient entropy to prevent prediction; replace any predictable/sequential identifier scheme.
Seattle Lab Software Emurl session_id_generation = cryptographically-random - Compensating control
Until application fixes are deployed, apply WAF or reverse-proxy rules to detect and block attempts to enumerate or manipulate session identifiers in URLs, and consider restricting webmail access to trusted networks or IP ranges.
- Operational
Invalidate existing sessions and force users to re-authenticate (expire or rotate session identifiers) so any previously exposed or predictable session identifiers cannot be used.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0397?
CVE-2000-0397 is categorized as a moderate severity vulnerability due to its impact on user account privacy.
How do I fix CVE-2000-0397?
To address CVE-2000-0397, update the EMURL application to a version that corrects the improper encoding of session identifiers in URLs.
Who is affected by CVE-2000-0397?
Users of EMURL version 2.0 are potentially affected by CVE-2000-0397, as it allows unauthorized access to email accounts.
What does CVE-2000-0397 exploit?
CVE-2000-0397 exploits predictable identifiers in user session URLs to allow attackers unauthorized access to email accounts.
When was CVE-2000-0397 disclosed?
CVE-2000-0397 was disclosed in May 2000.