A vulnerability classified as problematic has been found in Netegrity SiteMinder (affected version not known). Affected is some unknown functionality of the file siteminderagent/SmMakeCookie.ccc. The manipulation of the argument SMSESSION with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a session ID string in the value of the SMSESSION parameter in a URL, which might allow remote attackers to obtain the ID by sniffing, reading Referer logs, or other methods.

The weakness was published 05/29/2003 by David Withnall (Website). The advisory is shared for download at curl.haxx.se. This vulnerability is traded as CVE-2003-1312 since 12/15/2006. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a exploit are known. The MITRE ATT&CK project declares the attack technique as T1592.

After before and not just, there has been an exploit disclosed. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entry is available at VDB-21239.

Productinfo

Vendor

• Netegrity

Name

• SiteMinder

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion