CVE-2023-45718
09.02.2024, 22:15
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session.Enginsight
| Vendor | Product | Version |
|---|---|---|
| hcltech | sametime | 11.5 ≤ 𝑥 < 12.0.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-384 - Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
- CWE-613 - Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."