TUCoPS :: Web :: CMS / Portals

TUCoPS :: Web :: CMS / Portals :: c07-1425.htm
CA CleverPath Portal Session Inheritance Vulnerability
: CA CleverPath Portal Session Inheritance Vulnerability : CA CleverPath Portal Session Inheritance Vulnerability

DQpUaXRsZTogQ0FJRCAzNDg3NjogQ0EgQ2xldmVyUGF0aCBQb3J0YWwgU2Vzc2lvbiBJbmhlcml0
YW5jZQ0KVnVsbmVyYWJpbGl0eQ0KDQpDQSBWdWxuZXJhYmlsaXR5IElEIChDQUlEKTogMzQ4NzYN
Cg0KQ0EgQWR2aXNvcnkgRGF0ZTogMjAwNi0xMi0xOQ0KDQpEaXNjb3ZlcmVkIEJ5OiBDQSBjdXN0
b21lciBhbmQgQ0EgVGVjaG5pY2FsIFN1cHBvcnQNCg0KSW1wYWN0OiBSZW1vdGUgYXR0YWNrZXJz
IGNhbiBwb3RlbnRpYWxseSBnYWluIGFjY2VzcyB0byBhIHVzZXIncyANClBvcnRhbCBzZXNzaW9u
Lg0KDQpTdW1tYXJ5OiBDQSBDbGV2ZXJQYXRoIFBvcnRhbCBhbmQgb3RoZXIgQ0Egc29sdXRpb25z
IHRoYXQgZW1iZWQgDQpQb3J0YWwgdGVjaG5vbG9neSBjb250YWluIGEgc2Vzc2lvbiB2ZXJpZmlj
YXRpb24gdnVsbmVyYWJpbGl0eS4gIA0KSW4gY2VydGFpbiBtdWx0aXBsZSBQb3J0YWwgc2VydmVy
IGNvbmZpZ3VyYXRpb25zLCBhIHVzZXIgd2hvIA0KY29ubmVjdHMgdGhyb3VnaCBvbmUgUG9ydGFs
IHNlcnZlciBjb3VsZCBjb25jZWl2YWJseSBpbmhlcml0IHRoZSANClBvcnRhbCBzZXNzaW9uIGFu
ZCBhc3NvY2lhdGVkIHNlY3VyaXR5IGF1dGhlbnRpY2F0aW9uIG9mIGEgdXNlciANCnJ1bm5pbmcg
b24gYW5vdGhlciBQb3J0YWwgc2VydmVyLg0KDQpNaXRpZ2F0aW5nIEZhY3RvcnM6IFRoaXMgcHJv
YmxlbSBvbmx5IG9jY3VycyB3aGVuIG11bHRpcGxlIFBvcnRhbCANCnNlcnZlcnMgYXJlIHNoYXJp
bmcgYSBjb21tb24gZGF0YSBzdG9yZSwgYW5kIHR3byBvZiB0aGUgUG9ydGFsIA0Kc2VydmVycyBh
cmUgc3RhcnRlZCBhdCBleGFjdGx5IHRoZSBzYW1lIHRpbWUuIFR5cGljYWxseSwgY3VzdG9tZXJz
IA0KZGVwbG95IG11bHRpcGxlIFBvcnRhbCBzZXJ2ZXJzIGluIHRoaXMgdHlwZSBvZiBjb25maWd1
cmF0aW9uIHRvIA0KdXRpbGl6ZSBoaWdoLWF2YWlsYWJpbGl0eSBmYWlsb3ZlciBhbmQgbG9hZCBi
YWxhbmNpbmcuIEEgbXVsdGkgDQpDbGV2ZXJQYXRoIFBvcnRhbCBzZXJ2ZXIgZW52aXJvbm1lbnQg
aXMgbm90IGEgZGVmYXVsdCBkZXBsb3ltZW50LCANCmJ1dCBpdCBpcyBhbiBvcHRpb25hbCBwb3N0
IGluc3RhbGxhdGlvbiBjb25maWd1cmF0aW9uLiBOb25lIG9mIHRoZSANCkNBIHNvbHV0aW9ucyB0
aGF0IGVtYmVkIHRoZSBQb3J0YWwgdGVjaG5vbG9neSBpbnN0YWxsIGludG8gdGhpcyANCnNjZW5h
cmlvLCBvciBvZmZlciBhIG11bHRpcGxlIFBvcnRhbCBzZXJ2ZXIgZW52aXJvbm1lbnQgYXMgYSAN
CmNvbmZpZ3VyYWJsZSBvcHRpb24uIEhvd2V2ZXIsIGl0IGlzIGNvbmNlaXZhYmxlIHRoYXQgYSAN
Cmtub3dsZWRnZWFibGUgYWRtaW5pc3RyYXRvciBjb3VsZCBoYXZlIG1vZGlmaWVkIGFuIGVtYmVk
ZGVkIFBvcnRhbCANCmVudmlyb25tZW50IHRvIGxldmVyYWdlIG11bHRpcGxlIFBvcnRhbCBzZXJ2
ZXJzLg0KDQpTZXZlcml0eTogQ0EgaGFzIGdpdmVuIHRoaXMgdnVsbmVyYWJpbGl0eSBhIExvdyBy
aXNrIHJhdGluZy4NCg0KQWZmZWN0ZWQgUHJvZHVjdHM6DQpDbGV2ZXJQYXRoIFBvcnRhbCByNC41
MQ0KQ2xldmVyUGF0aCBQb3J0YWwgcjQuNw0KQ2xldmVyUGF0aCBQb3J0YWwgcjQuNzENCkJyaWdo
dFN0b3IgUG9ydGFsIHIxMS4xDQpDbGV2ZXJQYXRoIEFpb24gQlBNIHIxMA0KQ2xldmVyUGF0aCBB
aW9uIEJQTSByMTAuMQ0KQ2xldmVyUGF0aCBBaW9uIEJQTSByMTAuMg0KZVRydXN0IFNlY3VyaXR5
IENvbW1hbmQgQ2VudGVyIHIxDQplVHJ1c3QgU2VjdXJpdHkgQ29tbWFuZCBDZW50ZXIgcjgNClVu
aWNlbnRlciBBc3NldCBhbmQgUG9ydGZvbGlvIE1hbmFnZW1lbnQgcjExDQpVbmljZW50ZXIgRGF0
YWJhc2UgTWFuYWdlbWVudCBQb3J0YWwgcjExDQpVbmljZW50ZXIgRGF0YWJhc2UgQ29tbWFuZCBD
ZW50ZXIgcjExLjENClVuaWNlbnRlciBFbnRlcnByaXNlIEpvYiBNYW5hZ2VyIHIxIFNQMw0KVW5p
Y2VudGVyIFdvcmtsb2FkIENvbnRyb2wgQ2VudGVyIHIxIFNQNA0KVW5pY2VudGVyIE1hbmFnZW1l
bnQgUG9ydGFsIHIyLjANClVuaWNlbnRlciBNYW5hZ2VtZW50IFBvcnRhbCByMy4xDQpVbmljZW50
ZXIgTWFuYWdlbWVudCBQb3J0YWwgcjExLjANCg0KQWZmZWN0ZWQgcGxhdGZvcm1zOg0KQWxsIHN1
cHBvcnRlZCBvcGVyYXRpbmcgc3lzdGVtcyAoV2luZG93cywgTGludXgsIGFuZCBzdXBwb3J0ZWQg
DQpVTklYIHBsYXRmb3JtcykuDQoNClN0YXR1cyBhbmQgUmVjb21tZW5kYXRpb246IA0KVGhlIG1v
c3QgcHJ1ZGVudCBjb3Vyc2Ugb2YgYWN0aW9uIGZvciBhZmZlY3RlZCBjdXN0b21lcnMgaXMgdG8g
DQpkb3dubG9hZCBhbmQgYXBwbHkgdGhlIGNvcnJlY3RpdmUgbWFpbnRlbmFuY2UuIElmIHRoZSBt
YWludGVuYW5jZSANCmNhbm5vdCBiZSBhcHBsaWVkIHJpZ2h0IGF3YXksIENBIFRlY2huaWNhbCBT
dXBwb3J0IHJlY29tbWVuZHMgDQppbXBsZW1lbnRpbmcgaW50ZXJpbSBvcGVyYXRpb25hbCBwcm9j
ZXNzIGNvbnRyb2xzIHRvIGVuc3VyZSwgd2hlbiANCm11bHRpcGxlIFBvcnRhbCBzZXJ2ZXJzIGFy
ZSBzaGFyaW5nIGEgY29tbW9uIGRhdGEgc3RvcmUsIHRoYXQgdGhlIA0Kc2VydmVyIHN0YXJ0IHRp
bWVzIGFyZSBkdWx5IHN0YWdnZXJlZCBieSBhdCBsZWFzdCBvbmUgbWludXRlLg0KDQpEZXRlcm1p
bmluZyBpZiB5b3UgYXJlIGFmZmVjdGVkOiANCkFmZmVjdGVkIFBvcnRhbCBpbnN0YWxsYXRpb25z
IG11c3QgbWVldCBib3RoIG9mIHRoZSBmb2xsb3dpbmcgDQpjcml0ZXJpYToNCjEpIFlvdSBhcmUg
bm90IGF0IFBvcnRhbCBtYWludGVuYW5jZSB2ZXJzaW9uIDQuNzEuMDAxXzE3OV8wNjA4MzAgDQog
ICBvciBoaWdoZXIuIFRvIGRldGVybWluZSB5b3VyIHBvcnRhbCB2ZXJzaW9uOg0KICAgYS4gTG9n
aW4gYXMgYSBQb3J0YWwgQWRtaW5pc3RyYXRvci4NCiAgIGIuIENob29zZSAiTXkgUHJvZmlsZSIg
ZnJvbSB0aGUgdXBwZXIgcmlnaHQtaGFuZCBwb3J0aW9uIG9mIHRoZSANCiAgICAgIG1haW4gd29y
a3BsYWNlLg0KICAgYy4gQ2xpY2sgb24gdGhlICJQb3J0YWwgQWRtaW5pc3RyYXRpb24iIGxpbmsu
DQogICBkLiBUaGUgUG9ydGFsIHZlcnNpb24gd2lsbCBiZSBkaXNwbGF5ZWQgaW4gdGhlIHJpZ2h0
LWhhbmQgcGFuZSANCiAgICAgIHVuZGVyIFN0YXRpc3RpY3MuDQoyKSBZb3UgYXJlIHJ1bm5pbmcg
Q0EncyBQb3J0YWwgdGVjaG5vbG9neSBpbiBhIG11bHRpLXNlcnZlciANCiAgIGVudmlyb25tZW50
LiBUbyBkZXRlcm1pbmUgaWYgeW91IGFyZSBydW5uaW5nIGEgbXVsdGktc2VydmVyIA0KICAgZW52
aXJvbm1lbnQ6DQogICBhLiBMb2dpbiBhcyBhIFBvcnRhbCBBZG1pbmlzdHJhdG9yLg0KICAgYi4g
Q2hvb3NlICJNeSBQcm9maWxlIiBmcm9tIHRoZSB1cHBlciByaWdodC1oYW5kIHBvcnRpb24gb2Yg
dGhlIA0KICAgICAgbWFpbiB3b3JrcGxhY2UuDQogICBjLiBDbGljayBvbiB0aGUgIlBvcnRhbCBB
ZG1pbmlzdHJhdGlvbiIgbGluay4NCiAgIGQuIElmIHRoZSAiSnVtcCB0byBQb3J0YWwiIG1lbnUg
YXBwZWFycyBpbiB0aGUgbGVmdCBQb3J0YWwgDQogICAgICBBZG1pbmlzdHJhdGlvbiBwYW5lLCB5
b3UgYXJlIHVzaW5nIGEgbXVsdGlwbGUtc2VydmVyIA0KICAgICAgZW52aXJvbm1lbnQuIElmIHlv
dSBkbyBub3Qgc2VlIHRoZSAiSnVtcCB0byBQb3J0YWwiIHNlY3Rpb24sIA0KICAgICAgdGhlbiBQ
b3J0YWwgaXMgbm90IHJ1bm5pbmcgaW4gYSBtdWx0aS1zZXJ2ZXIgZW52aXJvbm1lbnQgYW5kIA0K
ICAgICAgaXMgbm90IGFmZmVjdGVkIGJ5IHRoaXMgdnVsbmVyYWJpbGl0eS4NCk5vdGU6IHJlZmVy
IHRvIHRoZSBTdXBwb3J0Q29ubmVjdCBTZWN1cml0eSBOb3RpY2UgZm9yIGFkZGl0aW9uYWwgDQpp
bmZvcm1hdGlvbi4NCg0KUmVmZXJlbmNlcyAoVVJMcyBtYXkgd3JhcCk6IA0KQ0EgU3VwcG9ydENv
bm5lY3Q6DQpodHRwOi8vc3VwcG9ydGNvbm5lY3QuY2EuY29tLw0KQ0EgU3VwcG9ydENvbm5lY3Qg
c2VjdXJpdHkgbm90aWNlIGZvciB0aGlzIHZ1bG5lcmFiaWxpdHk6DQpJbXBvcnRhbnQgU2VjdXJp
dHkgTm90aWNlIGZvciBDQSBDbGV2ZXJQYXRoIGFuZCBFbWJlZGRlZCBQb3J0YWwNCkN1c3RvbWVy
cw0KaHR0cDovL3N1cHBvcnRjb25uZWN0dy5jYS5jb20vcHVibGljL2NhX2NvbW1vbl9kb2NzL2Nw
cG9ydGFsX3NlY25vdC5hc3ANClNvbHV0aW9uIERvY3VtZW50IFJlZmVyZW5jZSBBUEFSczogDQpS
ZWZlciB0byB0aGUgU3VwcG9ydENvbm5lY3QgU2VjdXJpdHkgTm90aWNlLg0KQ0EgU2VjdXJpdHkg
QWR2aXNvciBwb3N0aW5nOg0KQ0EgQ2xldmVyUGF0aCBQb3J0YWwgU2Vzc2lvbiBJbmhlcml0YW5j
ZSBWdWxuZXJhYmlsaXR5DQpodHRwOi8vd3d3My5jYS5jb20vc2VjdXJpdHlhZHZpc29yL25ld3Np
bmZvLw0KQ0FJRDogMzQ4NzYNCkNBSUQgQWR2aXNvcnkgbGluazogDQpodHRwOi8vd3d3My5jYS5j
b20vc2VjdXJpdHlhZHZpc29yL3Z1bG5pbmZvL3Z1bG4uYXNweD9pZD0zNDg3Ng0KQ1ZFIFJlZmVy
ZW5jZTogQ1ZFLTIwMDYtNjY0MQ0KaHR0cDovL2N2ZS5taXRyZS5vcmcvY2dpLWJpbi9jdmVuYW1l
LmNnaT9uYW1lPUNWRS0yMDA2LTY2NDENCk9TVkRCIFJlZmVyZW5jZTogT1NWREItMzA4NTQNCmh0
dHA6Ly9vc3ZkYi5vcmcvMzA4NTQNCg0KQ2hhbmdlbG9nIGZvciB0aGlzIGFkdmlzb3J5Og0KdjEu
MCAtIEluaXRpYWwgUmVsZWFzZQ0KDQpDdXN0b21lcnMgd2hvIHJlcXVpcmUgYWRkaXRpb25hbCBp
bmZvcm1hdGlvbiBzaG91bGQgY29udGFjdCBDQSANClRlY2huaWNhbCBTdXBwb3J0IGF0IGh0dHA6
Ly9zdXBwb3J0Y29ubmVjdC5jYS5jb20uDQoNCkZvciB0ZWNobmljYWwgcXVlc3Rpb25zIG9yIGNv
bW1lbnRzIHJlbGF0ZWQgdG8gdGhpcyBhZHZpc29yeSwNCnBsZWFzZSBzZW5kIGVtYWlsIHRvIHZ1
bG5AY2EuY29tLCBvciBjb250YWN0IG1lIGRpcmVjdGx5Lg0KDQpJZiB5b3UgZGlzY292ZXIgYSB2
dWxuZXJhYmlsaXR5IGluIENBIHByb2R1Y3RzLCBwbGVhc2UgcmVwb3J0DQp5b3VyIGZpbmRpbmdz
IHRvIHZ1bG5AY2EuY29tLCBvciB1dGlsaXplIG91ciAiU3VibWl0IGEgDQpWdWxuZXJhYmlsaXR5
IiBmb3JtLg0KVVJMOiBodHRwOi8vd3d3My5jYS5jb20vc2VjdXJpdHlhZHZpc29yL3Z1bG5pbmZv
L3N1Ym1pdC5hc3B4DQoNCg0KUmVnYXJkcywNCktlbiBXaWxsaWFtcyA7IDB4RTI5NDE5ODUNCkRp
cmVjdG9yLCBDQSBWdWxuZXJhYmlsaXR5IFJlc2VhcmNoDQoNCkNBLCBPbmUgQ0EgUGxhemEuIElz
bGFuZGlhLCBOWSAxMTc0OQ0KCQ0KQ29udGFjdCBodHRwOi8vd3d3My5jYS5jb20vY29udGFjdC8N
CkxlZ2FsIE5vdGljZSBodHRwOi8vd3d3My5jYS5jb20vbGVnYWwvDQpQcml2YWN5IFBvbGljeSBo
dHRwOi8vd3d3My5jYS5jb20vcHJpdmFjeS8NCkNvcHlyaWdodCDCqSAyMDA2IENBLiBBbGwgcmln
aHRzIHJlc2VydmVkLg0K