CVE-2004-0944

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

The web management interface for Mitel 3300 Integrated Communications Platform (ICP) before 4.2.2.11 generates easily predictable web session IDs, which allows remote attackers to hijack other sessions via the parentsessionid cookie.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.corsaire.com/advisories/c040817-002.txtVendor Advisory
http://www.mitel.com/DocController?documentId=14223Patch, Vendor Advisory
http://www.niscc.gov.uk/niscc/docs/re-20050228-00178.pdf?lang=enPatch, Vendor Advisory
http://www.corsaire.com/advisories/c040817-002.txtVendor Advisory
http://www.mitel.com/DocController?documentId=14223Patch, Vendor Advisory
http://www.niscc.gov.uk/niscc/docs/re-20050228-00178.pdf?lang=enPatch, Vendor Advisory

Timeline

Published: Feb 28, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-09455.0The web management interface for Mitel 3300 Integrated Communications Platform (ICP) before 4.2.2.11 allows remote authenticated users to ca CVE-2004-094610.0rquotad in nfs-utils (rquota_server.c) before 1.0.6-r6 on 64-bit architectures does not properly perform an integer conversion, which leads CVE-2004-094710.0Buffer overflow in unarj before 2.63a-r2 allows remote attackers to execute arbitrary code via an arj archive that contains long filenames.CVE-2004-09496.4The smb_recv_trans2 function call in the samba filesystem (smbfs) in Linux kernel 2.4 and 2.6 does not properly handle the re-assembly of fr CVE-2004-09505.0NetOp Host before 7.65 build 2004278 allows remote attackers to obtain sensitive hostname, username and local IP address information via (1)CVE-2004-09517.5The make_recovery command for the TFTP server in HP Ignite-UX before C.6.2.241 makes a copy of the password file in the TFTP directory tree,CVE-2004-09526.4HP-UX B.11.00 through B.11.23, when running Ignite-UX and using the add_new_client command, causes the TFTP server to set world-writable per CVE-2004-095310.0Buffer overflow in the C2S module in the open source Jabber 2.x server (Jabberd) allows remote attackers to cause a denial of service (appli CVE-2004-09565.0MySQL before 4.0.20 allows remote attackers to cause a denial of service (application crash) via a MATCH AGAINST query with an opening doubl CVE-2004-09576.8Unknown vulnerability in MySQL 3.23.58 and earlier, when a local user has privileges for a database whose name includes a "_" (underscore), CVE-2004-09585.0php_variables.c in PHP before 5.0.2 allows remote attackers to read sensitive memory contents via (1) GET, (2) POST, or (3) COOKIE GPC varia CVE-2004-09592.1rfc1867.c in PHP before 5.0.2 allows local users to upload files to arbitrary locations via a PHP script with a certain MIME header that cau