CVE-2010-3852: Medium severity red hat luci vulnerability
A security flaw was found in the way Luci administration application processed ticket cookies. A remote attacker, with certain knowledge of running Luci instance environment details could use this flaw to bypass standard Luci authentication mechanism (access resources which should be otherwise protected by authentication).
Other sources
The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3852?
CVE-2010-3852 is considered a high severity vulnerability due to its potential to allow unauthorized access to the Luci administration application.
How do I fix CVE-2010-3852?
To fix CVE-2010-3852, users should upgrade the Redhat Luci application to version 0.22.5 or later.
What applications are affected by CVE-2010-3852?
CVE-2010-3852 affects Redhat Luci versions up to and including 0.22.4.
What type of vulnerability is CVE-2010-3852?
CVE-2010-3852 is a remote authentication bypass vulnerability.
Can CVE-2010-3852 be exploited from a remote location?
Yes, a remote attacker with knowledge of the Luci instance can exploit CVE-2010-3852.