Red Hat Conga vulnerabilities
6 CVEs affecting Red Hat Conga, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-3521, published 2014-10-06.
More from Red Hat.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2011-0720, published 2011-02-03. High severity, CVSS 7.5. EPSS: 3.2% chance of exploitation in the next 30 days. Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and…
- CVE-2013-6496, published 2014-10-06. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1) homebase, (2) cluster, (3) storage, (4) portal_skins/custom, or (5) logs Luci extension.
- CVE-2007-4136, published 2007-11-14. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new connections) by repeatedly sending data or attempting connections.
- CVE-2014-3521, published 2014-10-06. Medium severity, CVSS 5.5. EPSS: 1.4% chance of exploitation in the next 30 days. The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
- CVE-2013-7347, published 2014-03-31. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been…
- CVE-2012-3359, published 2014-03-31. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this…