Internet Campus Solution

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:jenzabar:internet_campus_solution:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorJenzabar (c880d920-8ca0-5fa6-b8ce-a6d6956f5f11)
ProductInternet Campus Solution (124aabd9-3a82-5704-8d2c-70e59b54058f)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2020-8434 vulnerable 2026-06-08 05:27:16.524351 Details available
Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode it to a client-side cookie for persistent session authentication. By knowing the key and algorithm, an attacker can select any username, encrypt it, base64 encode it, and save it in their browser with the correct JICSLoginCookie cookie format to impersonate any real user in the JICS database without the need for authenticating (or verifying with MFA if implemented).
Published: 2020-05-19T12:29:46.000Z
Updated: 2024-08-04T09:56:28.309Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-10011 vulnerable 2026-06-08 05:12:21.910991 Details available
ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.
Published: 2019-03-25T18:07:07.000Z
Updated: 2024-08-04T22:10:08.978Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.