Reliance on Cookies without Validation and Integrity Checking
CVE-2022-38297
Summary
UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- NONE
- NONE
- HIGH
- HIGH
CWE-565 - Reliance on Cookies without Validation and Integrity Checking
The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
References
Advisory Timeline
- Published
