JVN#70075625
Aipo session fixation vulnerability
Overview
Aipo, groupware from Aimluck, Inc., contains a session fixation vulnerability.
Products Affected
- Aipo version V3.0.1.0 and earlier
- Aipo ASP version V3.0.1.0 and earlier
Description
Aipo from Aimluck, Inc. is groupware including functions such as scheduler and intra-blogging. Aipo contains a session fixation vulnerability which may allow an attacker to impersonate a user when the user logs into AIPO with the session ID sent by the attacker.
Impact
This vulnerability may allow an attacker to impersonate a user. As a result, the attacker may be able to perform operations authorized by the privilege of the user to disclose or alter information.
Solution
Update the Software
The vendor has released an updated program addressing this vulnerability. It is recommended that users apply the updated program. For more information, refer to the vendor's website.
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
Analyzed on 2008.09.28
| Measures | Conditions | Severity |
|---|---|---|
| Access Required | Routed - can be attacked over the Internet using packets |
|
| Authentication | None - anonymous or no authentication (IP addresses do not count) |
|
| User Interaction Required | Simple - the user must be convinced to take a standard action that does not feel harmful to most users, such as click on a link or view a file |
|
| Exploit Complexity | Low - little to no expertise and/or luck required to exploit (cross-site scripting) |
|
Credit
Yoshihiro Ishikawa of LAC Co., Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.
Other Information
| JPCERT Alert | |
| JPCERT Reports | |
| CERT Advisory | |
| CPNI Advisory | |
| TRnotes | |
| CVE | |
| JVN iPedia |
JVNDB-2007-000729 |