CVE-2024-27455

State: Published
Severity: 9.1 Critical
Published: Feb 26, 2024
Updated: Aug 14, 2024
Reserved: Feb 26, 2024

Description

In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. This is fixed in Assetwise ALIM Web 23.00.04.04 and Assetwise Information Integrity Server 23.00.02.03.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	CISA-ADP

Weaknesses

CWE-613 Insufficient Session Expiration
CWE-488 Exposure of Data Element to Wrong Session

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.bentley.com/advisories/be-2024-0001/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.