Ellucian Banner Enterprise Identity Services 8.3
Approved changes feed: RSS · Atom
cpe:2.3:a:ellucian:banner_enterprise_identity_services:8.3:*:*:*:*:*:*:*
part: a version: 8.3 update: *
| Vendor | Ellucian (45982b3d-a365-5a22-b224-26e6a77353c6) |
|---|---|
| Product | Banner Enterprise Identity Services (cc12d686-eb09-5d43-bd78-44512271a23f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-8978 |
vulnerable | 2026-06-08 05:14:24.772972 |
Details available
An improper authentication vulnerability can be exploited through a race condition that occurs in Ellucian Banner Web Tailor 8.8.3, 8.8.4, and 8.9 and Banner Enterprise Identity Services 8.3, 8.3.1, 8.3.2, and 8.4, in conjunction with SSO Manager. This vulnerability allows remote attackers to steal a victim's session (and cause a denial of service) by repeatedly requesting the initial Banner Web Tailor main page with the IDMSESSID cookie set to the victim's UDCID, which in the case tested is the institutional ID. During a login attempt by a victim, the attacker can leverage the race condition and will be issued the SESSID that was meant for this victim.
Published: 2019-05-14T18:37:43.000Z
Updated: 2024-08-04T21:31:37.473Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.