CVE-2009-4354 TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session ID in a session cookie, which allows remote attackers to hijack web sessions, probably related to the....
MediumCVSS 5.8
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not properly secure the session ID in a session cookie, which allows remote attackers to hijack web sessions, probably related to the "secure" flag for cookies in SSL sessions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| transware active mail | <= 2003 | No fix listed |
| transware active mail | = 1.422 | No fix listed |
| transware active mail | = 2.0 | No fix listed |
References
- JVN#36207497 third-party-advisory
- JVNDB-2009-000077 third-party-advisory
- www.transware.co.jp vendor-advisory
- activemail2003-cookie-info-disclosure(54752) vdb-entry