CVE-2014-1219

Published: Feb 14, 2014Modified: Apr 29, 2026

5.1

Vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability: 4.9 / Impact: 6.4

Source: NVD

Description

CA 2E Web Option r8.1.2 accepts a predictable substring of a W2E_SSNID session token in place of the entire token, which allows remote attackers to hijack sessions by changing characters at the end of this substring, as demonstrated by terminating a session via a modified SSNID parameter to web2edoc/close.htm.

Affected (1)

Products: Broadcom: 2e Web Option

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Broadcom 2e Web Option	Version r8.1.2

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/

Source: cve@mitre.org

http://www.securityfocus.com/bid/65537

Source: cve@mitre.org

http://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-1219/

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/65537

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.