CVE-2004-1478

3 documents3 sources
Severity
7.5HIGH
EPSS
7.2%
top 8.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Hitachi Cosminexus EnterpriseHitachi Cosminexus ServerMacromedia Coldfusion+1 more
Timeline
PublishedDec 31
Latest updateApr 29

Description

JRun 4.0 does not properly generate and handle the JSESSIONID, which allows remote attackers to perform a session fixation attack and hijack a user's HTTP session.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages4 packages

▶NVDmacromedia/jrun3.0, 3.1, 4.0+2
▶NVDmacromedia/coldfusion6.0, 6.1+1
▶NVDhitachi/cosminexus_serverweb_01-01_1, web_01-01_2+1
▶NVDhitachi/cosminexus_enterprise01_01_1, 01_02_2+1

Patches

Patch: secunia.com ↗Patch: www.kb.cert.org ↗Patch: www.macromedia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-ch92-569c-3rpj: JRun 4↗2022-04-29
▶
CVEList
CVE-2004-1478: JRun 4↗2005-02-13
▶
CVE-2004-1478 (HIGH CVSS 7.5) | JRun 4.0 does not properly generate | cvebase.io