CVE-2023-37570
Assigner: CERT-In
Published: 2023-08-08T08:11:08.948Z
State: PUBLISHED
title: Insufficient Session Expiration Vulnerability in Emagic Data Center Management Suite
problemTypes: descriptions: cweId: CWE-613
description: CWE-613 Insufficient Session Expiration
type: CWE
impacts: capecId: CAPEC-114
descriptions: value: CAPEC-114 Authentication Abuse
affected: vendor: ESDS
product: Emagic Data Center Management Suite
versions: status: affected
version: 0
lessThanOrEqual: V6.0
versionType: custom
defaultStatus: unaffected
descriptions: value: This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. 
By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.

supportingMedia: type: text/html
base64: no
value: This vulnerability exists in ESDS Emagic Data Center Management Suit due to non-expiry of session cookie. <br>By reusing the stolen cookie, a remote attacker could gain unauthorized access to the targeted system.<br>
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
solutions: value: Upgrade to Enlight360 Datacenter Management Center Suite with latest version v8.9

supportingMedia: type: text/html
base64: no
value: Upgrade to Enlight360 Datacenter Management Center Suite with latest version v8.9<br>
credits: value: Chinamay Joshi of ESDS Software Solution Limited, Maharashtra
type: finder
source: discovery: UNKNOWN