345 – Security controls bypass or absence - Session Invalidation
Description
A function is implemented in the application that returns the users Main from his session code. However, since the source code used in the debugging phase was left in this functionality, if a session code containing the word auto is used, access is allowed.
Impact
- Exploit the logic introduced by the debugging code to access the application without having credentials. - Put in a session code the word auto and manage to access the application with a Main used during the testing phase.
Recommendation
Remove the code used during testing.
Threat
Anonymous attacker from the Internet.
Expected Remediation Time
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: N
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): N
- Availability (VA): N
- Confidentiality (SC): N
- Integrity (SI): N
- Availability (SA): N
Threat 4.0
- Exploit maturity: P