CVE-2009-4655 : The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cook

The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.

Published 2010-02-26 18:30:00

Updated 2025-04-11 00:51:22

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2009-4655

Novell » Edirectory » Version: 8.8.5
cpe:2.3:a:novell:edirectory:8.8.5:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-4655

EPSS FAQ

60.34%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-4655

Novell eDirectory DHOST Predictable Session Cookie

First seen: 2020-04-26

auxiliary/admin/edirectory/edirectory_dhost_cookie

This module is able to predict the next session cookie value issued by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run this module, wait until the real administrator logs in, then specify the predicted cookie value to hijack their session. Auth

More information

CVSS scores for CVE-2009-4655

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2009-4655

CWE-310

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-4655

Jump to