CVE-2024-28144 — Broken Access Control
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users …
Published: 2024-12-12 · CVSS: 5.5 · CVSS 3.1
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7