CVE-2010-3852

MEDIO 6.4CVE-2010-3852 · Published 06/11/2010 · updated 16/06/2026

En resumen

CVE-2010-3852 es una vulnerabilidad MEDIO (CVSS 6.4) que afecta a luci (redhat).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.0%, mayor que el 80.9% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
luci redhat	`≤ 0.22.4`	No fix yet

Description

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.

References

git.fedorahosted.org/git
lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html
lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html
lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html
osvdb.org/69015
secunia.com/advisories/42113 · Vendor Advisory
secunia.com/advisories/42123 · Vendor Advisory
securityfocus.com/bid/44611
vupen.com/english/advisories/2010/2873 · Vendor Advisory
vupen.com/english/advisories/2010/2900
bugzilla.redhat.com/show_bug.cgi
exchange.xforce.ibmcloud.com/vulnerabilities/62980

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free