Aleksandar Marčeta-Pavlović

SEPPmail Secure Email Gateway & SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay & hijack a user session in the GINA web portal, as the session token is disclosed inside the URL and a HTTP header.

**Name of the Vulnerable Software and Affected Versions** AgilePoint NX versions 8.0 SU2.2 through 8.0 SU2.3 **Description** The issue allows path traversal and downloading files from the server through an unspecified request. **Recommendations** For AgilePoint NX versions 8.0 SU2.2 and 8.0 SU2.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.