CVE-2024-28144

Summary

An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user.

Affected Software

Weaknesses

• CWE-384: CWE-384 Session Fixation

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• http://seclists.org/fulldisclosure/2024/Dec/2

References

• https://r.sec-consult.com/imageaccess
• https://www.imageaccess.de/?page=SupportPortal&lang=en

• ←Previous
• Next→