PT-2025-9801 · Unknown · Foreseer Reporting

Published 2025-03-05 · Updated 2025-03-06 · CVE-2025-22493

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Foreseer Reporting Software (FRS) versions prior to 1.5.100

Description The issue arises from the secure flag not being set and the SameSite attribute being set to Lax in the Foreseer Reporting Software. This could lead to the session cookie being transmitted over unencrypted HTTP connections, posing a security risk.

Recommendations For versions prior to 1.5.100, update to the latest version of FRS, which is version 1.5.100, to resolve the security issue.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

CVE-2025-22493

Affected Products

Foreseer Reporting

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-22493 · Security Note
• https://twitter.com/CVEnew/status/1897506950100746286 · Twitter Post
• https://eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1009.pdf · Note