JVNDB-2008-000047

LacoodaST from SpaceTag, Inc. session fixation vulnerability

LacoodaST from SpaceTag, Inc. contains a session fixation vulnerability.

LacoodaST from SpaceTag, Inc. is groupware providing schedule and task managements, etc. LacoodaST contains a session fixation vulnerability.

Hirotaka Katagiri reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendor under Information Security Early Warning Partnership.

Base Metrics: 5.8 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Medium
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: None

SPACETAG INC.

• LacoodaST 2.1.3 and earlier

A remote attacker impersonating a logged in user could manipulate the operation with the user's privilege. As a result, disclosure or alteration of information may occur.

[Update the Software]
Apply the latest update provided by the vendor.
For more information, refer to the vendor's website.

SPACETAG INC.

• News : about LacoodaST vulnerability

1. JVN : JVN#31723154
2. National Vulnerability Database (NVD) : CVE-2008-3738
3. Common Vulnerabilities and Exposures (CVE) : CVE-2008-3738
4. Secunia Advisory : SA31582
5. SecurityFocus : 30791
6. Common Weakness Enumeration (CWE) : Credentials Management (CWE-255) [IPA Evaluation]
7. JVN iPedia (Japanese) : JVNDB-2008-000047

[2008/09/02]
  Web page published