CVE-2013-7347: Low severity redhat Conga vulnerability
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7347?
CVE-2013-7347 is rated as a medium severity vulnerability due to its potential to allow unauthorized access to user sessions.
How do I fix CVE-2013-7347?
To fix CVE-2013-7347, update to the latest version of Red Hat Conga that addresses this session timeout enforcement issue.
What impact does CVE-2013-7347 have on security?
CVE-2013-7347 can lead to an unauthorized user gaining access to a valid session, putting sensitive information at risk.
Which software versions are affected by CVE-2013-7347?
CVE-2013-7347 affects Red Hat Conga, as well as Red Hat Enterprise Linux 5 and possibly other versions.
Is there a workaround for CVE-2013-7347?
A temporary workaround for CVE-2013-7347 includes manually clearing session cookies to prevent unauthorized access until a patch is applied.