vulnwire
5.0med

CVE-2004-0944

The web management interface for Mitel 3300 Integrated Communications Platform (ICP) before 4.2.2.11 generates easily predictable web sessi…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
0
none known

The web management interface for Mitel 3300 Integrated Communications Platform (ICP) before 4.2.2.11 generates easily predictable web session IDs, which allows remote attackers to hijack other sessions via the parentsessionid cookie.

Exploit prediction (EPSS)

1.37% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

References

  • corsaire.com /advisories/c040817-002.txt · x_refsource_MISC, x_transferred
  • niscc.gov.uk /niscc/docs/re-20050228-00178.pdf?lang=en · x_refsource_MISC, x_transferred
  • mitel.com /DocController?documentId=14223 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.