CVE-2017-6529
HighSummary
An issue was discovered in dnaTools dnaLIMS version 4-2015s13 related to session hijacking by guessing the UID parameter.
Risk Assessment
Session hijacking can lead to unauthorized access to user data, posing a serious threat to information security within the organization.
Recommendation
It is recommended to implement stronger authentication mechanisms and to monitor and restrict access to session parameters.
Other vulnerabilities in dnaTools dnaLIMS 4-2015s13
See all- CVE-2017-6528High
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to plaintext password storage. The /home/dna/spool/.pfile file contains passwords in plain text.
- CVE-2017-6527High
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to a NUL-terminated directory traversal attack allowing an unauthenticated attacker to access system files readable by the web server user.
- CVE-2017-6526Critical
An issue was discovered in dnaTools dnaLIMS 4-2015s13 related to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi in POST requests).
Original NVD description (English source)
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.