CVE-2024-25977
High
Description
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
SeverityHigh
CVSS7.3
Exploit probability—
ProductHAWKI
PublishedMay 29, 2024
First seenMay 29, 2024
Weakness typeCWE-384CWE-384
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany HAWKI | versions before commit 146967f | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.