Session Storage Vulnerability in JetBrains Ktor
CVE-2021-25761

5.3MEDIUM

Key Information:

Vendor
Jetbrains
Status
Ktor
Vendor
CVE Published:
3 February 2021

Summary

Earlier versions of JetBrains Ktor, prior to 1.5.0, are susceptible to a birthday attack targeting the SessionStorage key. This vulnerability allows an attacker to potentially predict the session key based on specific patterns in session identifiers. As a consequence, attackers may gain unauthorized access to user sessions, leading to serious security implications. Developers using Ktor are advised to upgrade to the latest version to mitigate this risk.

References

https://blog.jetbrains.com
x_refsource_MISC
https://blog.jetbrains.com/blog/2021/02/03/jetbrains-secu...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.