Описание
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
Ссылки
- Third Party Advisory
- ExploitThird Party Advisory
- Product
Уязвимые конфигурации
Конфигурация 1Версия до 7.10.4.0 (включая)
cpe:2.3:a:rocketsoftware:trufusion_enterprise:*:*:*:*:*:*:*:*
EPSS
Процентиль: 91%
0.06873
Низкий
7.5 High
CVSS3
Дефекты
CWE-1004
Связанные уязвимости
CVSS3: 7.5
github
6 дней назад
TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to sensitive internal information.
EPSS
Процентиль: 91%
0.06873
Низкий
7.5 High
CVSS3
Дефекты
CWE-1004