CVE-2013-7347
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow...
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
Exploit likelihood
What each source reports
NVD Score used
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
- Record
CVE-2013-7347- CVSS 2.0
- 3.7 Low
AV:L/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
- Record
CVE-2013-7347- Updated
- 2026-11-02
EUVDEUVD-2013-7119 No score
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
- Record
EUVD-2013-7119- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9fpf-6wcx-rjjm No score
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow...
Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain access to the session by reading the __ac session cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2012-3359 for the base64-encoded storage of the user and password in a cookie.
- Record
GHSA-9fpf-6wcx-rjjm- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-7347 is a low vulnerability (CVSS 3.7) in Redhat Conga, published March 30, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.