Session Management Flaw in eteams OA v4.0.34 Allows Unauthorized Data Access
CVE-2019-16133

6.5MEDIUM

Key Information:

Vendor

Weaver

Status
Eteams Oa
Vendor
CVE Published:
9 September 2019

What is CVE-2019-16133?

A session management vulnerability exists in eteams OA version 4.0.34 that allows an attacker to exploit insufficient session validation. This issue enables attackers to gain unauthorized access to sensitive information such as account names and passwords of all employees through a manipulated jsessionid value sent to URIs under app/profile/summary/. As a result, an ordinary user account can be used to retrieve confidential employee data, highlighting a critical need for implementing stricter session controls.

References

http://www.iwantacve.cn/index.php/archives/271/
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.