PT-2021-2273
CVE-2020-12528
·
تاريخ النشر
2021-03-02
·
تاريخ التحديث
2021-03-09
الوصف من
CVSS 3.1
7.7
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions:
mymbCONNECT24 and mbCONNECT24 versions through V2.6.2
Description:
The issue is related to improper use of access validation, allowing a logged-in user to kill web2go sessions in an account they should not have access to. This is due to insecure privilege management, which can be exploited by a remote attacker to terminate web2go sessions in unauthorized accounts.
Recommendations:
For versions through V2.6.2, consider restricting access to the web2go session management functionality until a patch is available. As a temporary workaround, limit the privileges of logged-in users to prevent them from accessing accounts they should not have access to.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾