CVE-2012-3359
Fixed in a distro release EPSS <1%
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
Products: redhat conga, redhat enterprise_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhel cluster 5 | conga | 0:0.12.2-64.el5 |
| Red Hat rhel cluster 5 | conga-debuginfo | 0:0.12.2-64.el5 |
| Red Hat rhel cluster 5 | luci | 0:0.12.2-64.el5 |
| Red Hat rhel cluster 5 | ricci | 0:0.12.2-64.el5 |