Description
Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Cluster 5 | luci +2 | 0.12.2-64.el5 | RHSA-2013:0128 |
Advisories 1
- RHSA-2013:0128 Red Hat Security Advisory: conga security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=607179
- RHSA-2013:0128 vendor-advisory