CVE-2006-4099 Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values.
HighCVSS 7.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| businessobjects crystal enterprise | = 9 | No fix listed |
| businessobjects crystal enterprise | = 10 | No fix listed |
References
- 23137 patch third-party-advisory vendor-advisory
- support.businessobjects.com
- www.mwrinfosecurity.com vendor-advisory
- 21350 vdb-entry
- www.uniras.gov.uk patch vendor-advisory
- ADV-2006-4748 vdb-entry
- crystalreports-wcsid-session-hijacking(30568) vdb-entry