PT-2021-9705 · Hcl · Hcl Onetest Performance

Published 2021-02-04 · Updated 2021-02-09 · CVE-2020-14247

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL OneTest Performance versions 9.5 through 10.1

Description The issue is related to an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID.

Recommendations For versions 9.5 through 10.1, consider implementing a more secure session timeout mechanism to minimize the risk of session ID guessing. As a temporary workaround, restrict access to sensitive areas of the application that rely on session IDs until a more secure timeout mechanism is implemented. Avoid using predictable or easily guessable session IDs in the affected versions until the issue is resolved.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2020-14247

Affected Products

Hcl Onetest Performance

References · 5

• https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0086469 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14247 · Security Note
• https://t.me/cvenotify/9405 · Telegram Post
• https://t.me/cibsecurity/23058 · Telegram Post