An issue was discovered in Halvotec RaQuest 10.23.10801.0. It allows session fixation. Fixed in Release 24.2020.20608.0.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Link | Tags |
---|---|
https://excellium-services.com/cert-xlm-advisory/ | third party advisory |
https://halvotec.de/produkte/raquest/ | product vendor advisory |
https://excellium-services.com/cert-xlm-advisory/cve-2019-19610/ | third party advisory |