PatchTheCVEconga vulnerabilities and fixes
Recent CVEs affecting conga, with upgrade or downgrade steps. 7 tracked.
conga has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2014-10-06. Highest priority: CVE-2011-0720 (score 53/100).
- CVE-2014-3521 MEDIUM 5.5 DOWNGRADE The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authentic
- CVE-2013-7347 LOW 3.7 MITIGATE MITIGATE Luci in Red Hat Conga does not properly enforce the user session timeout, which might allow attackers to gain
- CVE-2013-6496 MEDIUM 5.0 DOWNGRADE Red Hat Conga 0.12.2 allows remote attackers to obtain sensitive information via a crafted request to the (1)
- CVE-2012-3359 LOW 3.7 MITIGATE MITIGATE Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session c
- CVE-2011-0720 HIGH 7.5 DOWNGRADE MITIGATE Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allow
- CVE-2007-4136 MEDIUM 5.0 DOWNGRADE The ricci daemon in Red Hat Conga 0.10.0 allows remote attackers to cause a denial of service (loss of new con
- CVE-2007-1462 MEDIUM 4.3 MITIGATE The luci server component in conga preserves the password between page loads for the Add System/Cluster task f
FAQ
How do I fix conga vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is conga being exploited right now?
None of the tracked conga CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which conga CVE should I patch first?
CVE-2011-0720 currently ranks highest (53/100): Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allow.