cherokee-project cherokee 1.2.99 vulnerabilities and exploits

(subscribe to this query)

6.8

CVSSv2

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and previous versions, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote malicious users to bypass authentication via an empty password.

Fedoraproject Fedora 21 Fedoraproject Fedora 20 Fedoraproject Fedora 22 Mageia Project Mageia 4 Cherokee-project Cherokee 1.2.98 Cherokee-project Cherokee 1.2.2 Cherokee-project Cherokee 1.2.101 Cherokee-project Cherokee 1.2.99 Cherokee-project Cherokee Cherokee-project Cherokee 1.2.102

2.1

CVSSv2

The generate_admin_password function in Cherokee prior to 1.2.99 uses time and PID values for seeding of a random number generator, which makes it easier for local users to determine admin passwords via a brute-force attack.

6.8

CVSSv2

Cross-site request forgery (CSRF) vulnerability in Cherokee-admin in Cherokee prior to 1.2.99 allows remote malicious users to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences, as demonstrated by a crafted nickname field to...

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook