PT-2021-11757 · Domainmod · Domainmod

Published 2021-03-15 · Updated 2021-03-18 · CVE-2020-35358

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DomainMOD version 4.15.0

Description: The issue is related to insufficient session expiration. When a password is changed, sessions using the new password and old sessions on other browsers or devices do not expire, remaining active. This flaw can give attackers unauthorized access to system data or functionality.

Recommendations: For DomainMOD version 4.15.0, as a temporary workaround, consider implementing a manual session expiration mechanism after password changes until a patch is available. Restrict access to sensitive data and functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-35358

Affected Products

Domainmod

References · 4

• 🔥 https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7 · Exploit
• https://osv.dev/vulnerability/CVE-2020-35358 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35358 · Security Note
• https://t.me/cvenotify/11329 · Telegram Post