PT-2021-19169

Name of the Vulnerable Software and Affected Versions Netsia SEBA+ versions 0.16.1 and earlier, specifically build 70-e669dcd7 Description The issue allows remote attackers to discover session cookies via a direct "/session/list/allActiveSession" API endpoint request. This can lead to the discove...

CVE-2021-3113: Direct Request

Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, a...