Lucene search
GoogleOSV:CVE-2024-25977HistoryMay 29, 2024 - 1:15 p.m.
CVE-2024-25977
2024-05-2913:15:49
Google
osv.dev
3
application
session token
login/logout
account takeover
software
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim’s browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim’s account being taken over.
| CPE | Name | Operator | Version |
|---|---|---|---|
| hawki | eq | 1.0.0-beta.1 |
Related
vulnrichment
vulnrichment
CVE-2024-25977 Session Fixation
2024-05-29 12:31:29
nvd
nvd
CVE-2024-25977
2024-05-29 13:15:49
cve
cve
CVE-2024-25977
2024-05-29 13:15:49
cvelist
cvelist
CVE-2024-25977 Session Fixation
2024-05-29 12:31:29
packetstorm
packetstorm
HAWKI 1.0.0-beta.1 XSS / File Overwrite / Session Fixation
2024-05-28 00:00:00