CVE-2016-6545 iTrack Easy does not use session cookies to maintain sessions and POSTs the users password over HTTPS for each request

2018-07-1320:00:00

CWE-613

certcc

www.cve.org

9.6 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.5%

JSON

Session cookies are not used for maintaining valid sessions in iTrack Easy. The user’s password is passed as a POST parameter over HTTPS using a base64 encoded passwd field on every request. In this implementation, sessions can only be terminated when the user changes the associated password.

CNA Affected

[
  {
    "product": "Easy",
    "vendor": "iTrack",
    "versions": [
      {
        "status": "unknown",
        "version": "N/A"
      }
    ]
  }
]