CVE-2018-16495
- State
- Published
- Severity
- Not scored
- Published
- May 26, 2021
- Updated
- Aug 5, 2024
- Reserved
- Sep 4, 2018
Description
In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into the application. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with.
Scores
The record has no CVSS score.
Weaknesses
- CWE-384 Session Fixation (CWE-384)
Affected Products
| Product | Versions |
|---|---|
Versa VOSn/a |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.