« Volver al listado

CVE-2001-0922

Estado: ModificadaAlta (7.5)—

ndcgi.exe en Netdynamics 4.x hasta 5.x, y posiblemente en versiones anteriores, permite a atacantes remotos robar identificadores de sesión y secuestrar sesiones de usuario leyendo las variables SPIDERSESSION y uniqueValue del campo de inicio de sesión y, después, utilizando esas variables cuando el siguiente usuario inicie sesión.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SUN — Netdynamics

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2001-0922",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2001-11-26T05:00:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=100681274915525&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/3583",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7620",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=100681274915525&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/3583",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/7620",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ndcgi.exe in Netdynamics 4.x through 5.x, and possibly earlier versions, allows remote attackers to steal session IDs and hijack user sessions by reading the SPIDERSESSION and uniqueValue variables from the login field, then using those variables after the next user logs in."
    }
  ],
  "lastModified": "2026-06-16T21:55:14.013",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sun:netdynamics:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9846C76-7DAB-4A3D-B5BC-B3541DEC868A"
            },
            {
              "criteria": "cpe:2.3:a:sun:netdynamics:4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46C84C01-0FCE-4D08-93AC-10E2AFB27D83"
            },
            {
              "criteria": "cpe:2.3:a:sun:netdynamics:4.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F35F3413-2754-4466-8200-E96EF08CFC82"
            },
            {
              "criteria": "cpe:2.3:a:sun:netdynamics:4.1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2558DC6A-018B-4B67-A359-BA2027FADEEB"
            },
            {
              "criteria": "cpe:2.3:a:sun:netdynamics:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2081CC00-92A4-4351-BD52-3EC2464ADD00"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}