CVE-2010-5067

{"id": "CVE-2010-5067", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-10-08T10:47:44.807", "references": [{"url": "http://dmcdonald.net/vwar.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2010/Aug/235", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie."}, {"lang": "es", "value": "Virtual War (alias VWar) v1.6.1 R2 utiliza cookies de sesi\u00f3n est\u00e1ticas que dependen s\u00f3lo de la contrase\u00f1a de un usuario, lo que hace que sea m\u00e1s f\u00e1cil para los atacantes remotos evitar acciones de timeout o logout, y mantener el acceso durante un largo periodo de tiempo, al aprovechar el conocimiento de una cookie de sesi\u00f3n."}], "lastModified": "2012-10-08T10:47:44.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vwar:virtual_war:1.6.1:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F27251B8-7B01-4D5E-8858-76C875E2B581"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}