CVE-2025-24502
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jan 30, 2025
- Updated
- Feb 5, 2025
- Reserved
- Jan 22, 2025
Description
An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | symantec |
Weaknesses
- CWE-384 Session Fixation
Affected Products
| Product | Versions |
|---|---|
Symantec Privileged Access ManagementBroadcom |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.