Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

OneOrZero AIMS 2.7.0 lets attackers gain admin access via cookie

CVE-2011-4214 · published 15 years ago
Summary

The AIMS version 2.7.0 can be tricked into accepting a specially crafted browser cookie, allowing someone outside your network to log in as an administrator without a password. This gives the attacker full control over the system. Update to a newer version or apply the vendor's patch to protect your environment.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
oneorzero aims 2.7.0
cpe:2.3:a:oneorzero:aims:2.7.0:*:*:*:*:*:*:*
Original advisory text
OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie.
OneOrZero Action & Information Management System (AIMS) 2.7.0 allows remote attackers to bypass authentication and obtain administrator privileges via a crafted oozimsrememberme cookie.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
3% chance of attack within 30 days
Type
CWE-287Improper Authentication
Timeline
Published1 Nov 2011
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2011-4214 · NVD
Track software like this
Free during beta