JVNDB-2008-000083

Predictable session ID vulnerability in Access Analyzer CGI by futomi's CGI Cafe

Access Analyzer CGI from futomi's CGI Cafe contains a predictable session ID vulnerability.

Access Analyzer CGI provided by futomi's CGI Cafe is a software to analyze web access logs. Access Analyzer CGI contains a predictable session ID vulnerability.

Base Metrics: 5.8 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Medium
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: Partial
• Availability Impact: None

futomi Co.,Ltd.

• Access Analyzer CGI Professional Version Ver 4.0.1 and earlier
• Access Analyzer CGI Standard Version Ver 4.11.3 and earlier

A remote attacker could impersonate an administrator of Access Analyzer CGI. As a result, a remote attacker could view access analysis results of the website where the software resides.

[Update the Software]
Update to the latest version according to the information provided by the vendor.

futomi Co.,Ltd.

• futomi's CGI Cafe : Access Analyzer CGI Standard Version (Japanese)
• futomi's CGI Cafe : Access Analyzer CGI Professional Version (Japanese)
• futomi's CGI Cafe : New versions of Access Analyzer CGI Standard and Professional Versions (Japanese)

1. Improper Authentication(CWE-287) [IPA Evaluation]

1. CVE-2008-5809

1. JVN : JVN#07468800
2. National Vulnerability Database (NVD) : CVE-2008-5809
3. JVN iPedia (Japanese) : JVNDB-2008-000083

[2008/12/17]
  Web page published