CVE-2014-0906

Published: May 26, 2014Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not check whether a session cookie is current, which allows remote attackers to conduct user-search actions by leveraging possession of a (1) expired or (2) invalidated cookie.

Affected (11)

Products: Ibm: Sametime

Ibm

1 product

Sametime

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Ibm Sametime	Version 8.0.0.0
Ibm Sametime	Version 8.0.1.0
Ibm Sametime	Version 8.0.1.1
Ibm Sametime	Version 8.0.2.0
Ibm Sametime	Version 8.0.2.1
Ibm Sametime	Version 8.5.0.0
Ibm Sametime	Version 8.5.1.0
Ibm Sametime	Version 8.5.1.1
Ibm Sametime	Version 8.5.2.0
Ibm Sametime	Version 8.5.2.1
Ibm Sametime	Version 9.0.0.0

Related CWEs

CWE-264

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/91854

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21671201

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/91854

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.