CVE-2007-2232 The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie parameter.
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The CHECK command in Cosign 2.0.1 and earlier allows remote attackers to bypass authentication requirements via CR (\r) sequences in the cosign cookie parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cosign | = 0.7.0 | No fix listed |
| cosign | = 0.8.0 | No fix listed |
| cosign | = 0.9.0 | No fix listed |
| cosign | = 1.0 | No fix listed |
| cosign | = 1.1 | No fix listed |
| cosign | = 1.5 | No fix listed |
| cosign | = 1.6 | No fix listed |
| cosign | = 1.7 | No fix listed |
| cosign | = 1.8 | No fix listed |
| cosign | = 1.8.5 | No fix listed |
| cosign | = 1.9 | No fix listed |
| cosign | = 2.0.1 | No fix listed |
References
- 24845 patch third-party-advisory vendor-advisory
- 20070411 Cosign SSO Authentication Bypass mailing-list
- www.umich.edu vendor-advisory
- ADV-2007-1359 vdb-entry