PT-2024-21251 · Interaction Design Team At The University Of Applied Sciences Arts In Hildesheim/Germany+1 · Hawki

Florian Stuhlmann + 1 · Published 2024-05-29 · Updated 2024-11-21 · CVE-2024-25977

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned.

Description The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser, for example via XSS, and prompt the victim to log in, resulting in the victim's account being taken over.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2024-25977

Affected Products

Hawki

References · 8

• https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1 · Patch
• https://osv.dev/vulnerability/CVE-2024-25977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25977 · Security Note
• https://t.me/cvenotify/81396 · Telegram Post
• https://t.me/cvenotify/81369 · Telegram Post
• http://seclists.org/fulldisclosure/2024/May/34 · Note
• https://r.sec-consult.com/hawki · Note
• https://t.me/cvenotify/102336 · Telegram Post