CVE-2010-3852

The default configuration of Luci 0.22.4 and earlier in Red Hat Conga uses "[INSERT SECRET HERE]" as its secret key for cookies, which makes it easier for remote attackers to bypass repoze.who authentication via a forged ticket cookie.

• CWE-287

• http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html
• http://osvdb.org/69015
• http://secunia.com/advisories/42113Vendor Advisory
• http://secunia.com/advisories/42123Vendor Advisory
• http://www.securityfocus.com/bid/44611
• http://www.vupen.com/english/advisories/2010/2873Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2900
• https://bugzilla.redhat.com/show_bug.cgi?id=626504
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62980
• http://git.fedorahosted.org/git/?p=luci.git%3Ba=commit%3Bh=9e0bbf0c5faa198379d945474f7d55da5031cacf
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050244.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050246.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050309.html
• http://osvdb.org/69015
• http://secunia.com/advisories/42113Vendor Advisory
• http://secunia.com/advisories/42123Vendor Advisory
• http://www.securityfocus.com/bid/44611
• http://www.vupen.com/english/advisories/2010/2873Vendor Advisory
• http://www.vupen.com/english/advisories/2010/2900
• https://bugzilla.redhat.com/show_bug.cgi?id=626504
• https://exchange.xforce.ibmcloud.com/vulnerabilities/62980

Published

Nov 6, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-3846Array index error in the apply_rcs_change function in rcs.c …
• CVE-2010-3847elf/dl-load.c in ld.so in the GNU C Library (aka glibc or li…
• CVE-2010-3848Stack-based buffer overflow in the econet_sendmsg function i…
• CVE-2010-3849The econet_sendmsg function in net/econet/af_econet.c in the…
• CVE-2010-3850The ec_dev_ioctl function in net/econet/af_econet.c in the L…
• CVE-2010-3851libguestfs before 1.5.23, as used in virt-v2v, virt-inspecto…
• CVE-2010-3853pam_namespace.c in the pam_namespace module in Linux-PAM (ak…
• CVE-2010-3854Multiple cross-site scripting (XSS) vulnerabilities in the w…
• CVE-2010-3855Buffer overflow in the ft_var_readpackedpoints function in t…
• CVE-2010-3856ld.so in the GNU C Library (aka glibc or libc6) before 2.11.…
• CVE-2010-3857JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UU…6.1
• CVE-2010-3858The setup_arg_pages function in fs/exec.c in the Linux kerne…