by Kastro
Paper/Archive/CVE-2023-6144

CVE-2023-6144

Dev Blog Dev Blog — Dev Blog v1.0 - ATO

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
35
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 39.0.390 × 207.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.

Affected

ProductAffectedFixed inSource
Dev Blog1.0–CNA

Scores by source

Fluid Attacks (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

reffluidattacks.com/advisories/almightyrefgithub.com/Armanidrisi/devblog