Unauthenticated Remote Attackers Can Extract Session Token and Gain Web-Based Management Access

CVE-2024-28134

Summary

An unauthenticated remote attacker has the capability to exploit a vulnerability that allows the extraction of session tokens through a Man-in-the-Middle (MitM) attack. This occurs due to the insecure cleartext transmission of sensitive data within the web-based management interface. The attacker can gain access with the same privileges as the currently logged-in user, without requiring any additional interaction from the user. While the attacker may only access non-sensitive information, this vulnerability can significantly compromise the availability of the affected product, as it exposes potential risks in web management functionalities.

References