CVE-2021-29012

Name of the Vulnerable Software and Affected Versions: DMA Softlab Radius Manager version 4.4.0

Description: The issue allows for permanent access if the session cookie is stolen, as it is functionally equivalent to a static password. This occurs because the same session cookie is assigned to every admin session, and although it is invalid when the admin is logged out, it becomes valid again upon login.

Recommendations: For DMA Softlab Radius Manager version 4.4.0, consider implementing a unique session cookie for each admin session to prevent unauthorized access. As a temporary workaround, restrict access to sensitive areas of the application when an admin is logged out to minimize the risk of exploitation.