PT-2024-13264 · Unknown · Ailux Imx6 Bundle

Andrea Palanca · Published 2024-03-05 · Updated 2025-04-23 · CVE-2023-45600

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AiLux imx6 bundle versions prior to imx6 1.0.7-2

Description A CWE-613 “Insufficient Session Expiration” issue in the web application exists due to the session cookie sessionid lasting two weeks, which facilitates session hijacking attacks against victims.

Recommendations For versions prior to imx6 1.0.7-2, update to version imx6 1.0.7-2 or later to resolve the issue. As a temporary workaround, consider shortening the session expiration time to minimize the risk of session hijacking attacks. Restrict access to sensitive areas of the web application to minimize the risk of exploitation.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-45600

Affected Products

Ailux Imx6 Bundle

References · 6

• https://osv.dev/vulnerability/CVE-2023-45600 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45600 · Security Note
• https://twitter.com/CVEnew/status/1764982268265652707 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1765006620885500328 · Twitter Post
• https://nozominetworks.com/labs/vulnerability-advisories-cve-2023-45600 · Note
• https://t.me/cvenotify/119576 · Telegram Post