CVEvulnerability

CVE-2017-14013

5.6 MEDIUM Published 2017-10-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.6 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-602, CWE-669

Description

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or assume the identity of an authenticated user.

Affected configurations

• prominent multiflex m10a controller firmware

Related

Weakness · CWE (2)

  • CWE-602 Client-Side Enforcement of Server-Side Security weakness
  • CWE-669 Incorrect Resource Transfer Between Spheres weakness

References