PT-2021-18025 · Dma Softlab · Dma Softlab Radius Manager

Published 2021-04-02 · Updated 2022-07-12 · CVE-2021-29012

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DMA Softlab Radius Manager version 4.4.0

Description: The issue allows for permanent access if the session cookie is stolen, as it is functionally equivalent to a static password. This occurs because the same session cookie is assigned to every admin session, and although it is invalid when the admin is logged out, it becomes valid again upon login.

Recommendations: For DMA Softlab Radius Manager version 4.4.0, consider implementing a unique session cookie for each admin session to prevent unauthorized access. As a temporary workaround, restrict access to sensitive areas of the application when an admin is logged out to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-29012

Affected Products

Dma Softlab Radius Manager

References · 6

• 🔥 https://github.com/1d8/publications/tree/main/cve-2021-29012 · Exploit
• 🔥 http://packetstormsecurity.com/files/164154/DMA-Softlab-Radius-Manager-4.4.0-Session-Management-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-29012 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29012 · Security Note
• https://t.me/cvenotify/12822 · Telegram Post
• https://sourceforge.net/projects/radiusmanager · Note