Описание
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
Ссылки
- MitigationThird Party Advisory
- MitigationThird Party Advisory
- Release Notes
Уязвимые конфигурации
Конфигурация 1
Одно из
cpe:2.3:a:nagios:fusion:2024:r1.2:*:*:*:*:*:*
cpe:2.3:a:nagios:fusion:2024:r2.1:*:*:*:*:*:*
EPSS
Процентиль: 82%
0.01636
Низкий
8.6 High
CVSS3
Дефекты
CWE-491
Связанные уязвимости
CVSS3: 8.6
github
3 месяца назад
Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enabled, allowing attackers to perform a session hijacking attack.
EPSS
Процентиль: 82%
0.01636
Низкий
8.6 High
CVSS3
Дефекты
CWE-491