CVE-2009-4655

50Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 50%

from disclosure to weapon16 days

Published on NVDFeb 26

1st PoC+16d

exploitation probability

50%top 1% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/33767unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://osvdb.org/60035 https://exchange.xforce.ibmcloud.com/vulnerabilities/56613 http://www.metasploit.com/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie http://www.metasploit.com/redmine/projects/framework/repository/entry/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rb