CVE-2014-0906: Medium severity IBM Sametime vulnerability
The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a (1) expired or (2) invalidated cookie.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0906?
The severity of CVE-2014-0906 is classified as medium, as it can allow attackers to exploit session management shortcomings.
How do I fix CVE-2014-0906?
To fix CVE-2014-0906, update IBM Sametime to the latest version that is not affected by this vulnerability.
What types of cookies are affected by CVE-2014-0906?
CVE-2014-0906 affects both expired and invalidated session cookies.
What systems are impacted by CVE-2014-0906?
CVE-2014-0906 affects IBM Sametime versions from 8.x through 9.x, specifically versions up to 9.0.0.1.
Can CVE-2014-0906 lead to unauthorized access?
Yes, CVE-2014-0906 can allow remote attackers to conduct unauthorized user-search actions using session cookies.