Vulnerability in Arcserve Brightstor
CVE-2006-6641
Unspecified vulnerability in CA CleverPath Portal before maintenance version 4.71.001_179_060830, as used in multiple products including BrightStor Portal r11.1, CleverPath Aion BPM r10 through r10.2, eTrust Security Command Center r1 and r8, and Unicenter, does not properly handle when multiple Portal servers are started at the same time and share the same data store, which might cause a Portal user to inherit the session and credentials of a user who is on another Portal server.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.026 (84.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 85th percentile — 84.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.026 · newest: 0.026 · change: +0.000
Affected products
- Arcserve Brightstor — versions 11.1
- Broadcom Cleverpath Portal
- Cleverpath Aion Bpm — versions r10, r10.1, r10.2
- Cleverpath Portal — versions r4.7, r4.51, r4.71
- Etrust Security Command Center — versions r1, r8
- Unicenter Asset And Portfolio Management — versions r11
- Unicenter Database Command Center — versions r11.1
- Unicenter Database Management Portal — versions r11
- Unicenter Enterprise Job Manager — versions r1_sp3
- Unicenter Management Portal — versions r2.0, r3.1, r11.0
References
- www.securityfocus.com/bid/21681 (vdb-entry)
- www.vupen.com/english/advisories/2006/5091 (vdb-entry)
- supportconnectw.ca.com/public/ca_common_docs/cpportal_secnot.asp (Vendor Advisory)
- www.securityfocus.com/archive/1/455041/100/0/threaded (mailing-list)
- www.osvdb.org/30854 (vdb-entry)
- securitytracker.com/id (vdb-entry)
- www3.ca.com/securityadvisor/vulninfo/vuln.aspx
- secunia.com/advisories/23426 (third-party-advisory)