CVE-2009-4353

EUVD-2009-4321
The Mobile Edition of TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0911, does not remove the session ID in a Referer URL, which allows remote attackers to hijack web sessions via vectors such as an email with an embedded URL.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 57%
Affected Products (NVD)
VendorProductVersion
transwareactive\!_mail
𝑥
≤ 2003
𝑥
= Vulnerable software versions
References
http://jvn.jp/en/jp/JVN85821104/index.html
http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000076.html
http://secunia.com/advisories/37602
http://www.transware.co.jp/support_am/security/vulnerability3.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/54751
http://jvn.jp/en/jp/JVN85821104/index.html
http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000076.html
http://secunia.com/advisories/37602
http://www.transware.co.jp/support_am/security/vulnerability3.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/54751