CVEvulnerability
CVE-2021-3113
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-01-17
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-425
Description
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and can then use that cookie immediately for admin access,
Affected configurations
• netsia seba\+ (<= 0.16.1)
Related
Weakness · CWE (1)
- CWE-425 Direct Request weakness
References
- https://www.exploit-db.com/exploits/49435 Exploit, Third Party Advisory, VDB Entry
- https://www.netsia.com/#netsiaseba Vendor Advisory
- https://www.pentest.com.tr/exploits/Netsia-SEBA-0-16-1-Authentication-Bypass-Add-Root-User-Metasploit.html Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/49435 Exploit, Third Party Advisory, VDB Entry
- https://www.netsia.com/#netsiaseba Vendor Advisory
- https://www.pentest.com.tr/exploits/Netsia-SEBA-0-16-1-Authentication-Bypass-Add-Root-User-Metasploit.html Exploit, Third Party Advisory