CWE Code: 407
Vulnerability Type: privilege_escalation
CVSS Score: 4.0
CWE Name:  Inefficient Algorithmic Complexity
Summary: an issue was discovered in total.js cms 12.0.0. a low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. if an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with o(n)=2n instead of o(n)=n^x complexity, and steal the admin password.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2019-09-05
Last Modified Date: 2019-09-06