Lucene search

TR-CERTCVELIST:CVE-2024-0947

HistoryJun 27, 2024 - 9:27 a.m.

CVE-2024-0947 Cookies Manipulation in Talya Informatics' Elektraweb

2024-06-2709:27:41

CWE-565

TR-CERT

www.cve.org

talya informatics

elektraweb

cookies manipulation

session credential falsification

http cookies

data tokens

vulnerability

validation

integrity checking

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

39.3%

JSON

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens.This issue affects Elektraweb: before v17.0.68.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Elektraweb",
    "vendor": "Talya Informatics",
    "versions": [
      {
        "lessThan": "v17.0.68",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.usom.gov.tr/bildirim/tr-24-0808

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

39.3%

JSON

Related for CVELIST:CVE-2024-0947