CVEvulnerability

CVE-2018-16495

8.8 HIGH Published 2021-05-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-05-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-384

Description

In VOS user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after the user successfully logs into the application. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with.

Affected configurations

• versa-networks versa operating system (< 16.1r2s11) • versa-networks versa operating system (>= 20.2.0 < 20.2.2) • versa-networks versa operating system (>= 21.1.0 < 21.1.1)

Related

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References