Vulnerability in Hitachi Cosminexus Application Server
CVE-2007-4124
The session failover function in Cosminexus Component Container in Cosminexus 6, 6.7, and 7 before 20070731, as used in multiple Hitachi products, can use session data for the wrong user under unspecified conditions, which might allow remote authenticated users to obtain sensitive information, corrupt another user's session data, and possibly gain privileges.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.9 (Medium). Vector: AV:N/AC:M/Au:S/C:P/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.010 (61.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 61.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.010 · newest: 0.010 · change: 0.000
Affected products
- Hitachi Cosminexus Application Server — versions 6
- Hitachi Cosminexus Collaboration Portal
- Hitachi Cosminexus Developer — versions 6
- Hitachi Cosminexus Erp Integrator
- Hitachi Cosminexus Opentp1 Web Front-End Set
- Hitachi Electronic Form Workflow
- Hitachi Groupmax Collaboration Portal
- Hitachi Ucosminexus Application Server
- Hitachi Ucosminexus Collaboration Portal
- Hitachi Ucosminexus Developer
References
- www.securityfocus.com/bid/25145 (vdb-entry)
- www.vupen.com/english/advisories/2007/2725 (vdb-entry)
- exchange.xforce.ibmcloud.com/vulnerabilities/35706 (vdb-entry)
- osvdb.org/37852 (vdb-entry)
- secunia.com/advisories/26250 (Vendor Advisory, third-party-advisory)
- www.hitachi-support.com/security_e/vuls_e/HS07-024_e/index-e.html (Patch, Vendor Advisory)