Auth bypass in Oneorzero Aims

CVE-2011-4214

OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie.

Vulnerability class: Broken Authentication

EPSS: 0.031 (86.5th percentile) — read the EPSS interpretation.

Affected products

Oneorzero Aims — versions 2.7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

References

cve@mitre.org (x_refsource_MISC)
cve@mitre.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)
cve@mitre.org (vdb-entry, x_refsource_BID)