Описание
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
Ссылки
EPSS
Процентиль: 32%
0.00382
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-565
Связанные уязвимости
CVSS3: 9.8
github
19 дней назад
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
EPSS
Процентиль: 32%
0.00382
Низкий
9.8 Critical
CVSS3
Дефекты
CWE-565