CVE-2010-1507

Published: Sep 3, 2010Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

WebYaST in yast2-webclient in SUSE Linux Enterprise (SLE) 11 on the WebYaST appliance uses a fixed secret key that is embedded in the appliance's image, which allows remote attackers to spoof session cookies by leveraging knowledge of this key.

Affected (1)

Products: Novell: Suse Linux

Novell

1 product

Suse Linux

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Novell Suse Linux	Version 11

Running on/with	Platform Versions
Novell Webyast Appliance	All versions

Related CWEs

CWE-255

References (10)

http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html

Source: cve@mitre.org

http://support.novell.com/security/cve/CVE-2010-1507.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/42128

Source: cve@mitre.org

https://bugzilla.novell.com/show_bug.cgi?id=591345

Source: cve@mitre.org

https://bugzilla.novell.com/show_bug.cgi?id=598834

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html