CoreCVE
Back

LOW

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache

Published Apr 14, 2009

Description

Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Apr 14, 2009
Updated Aug 7, 2024
Reserved Apr 14, 2009
Link CVE-2008-6722
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 16, 2026
Link CVE-2008-6722
Red Hat
Severity n/a
Public date n/a
Links CVE-2008-6722