CVE-2024-29401

The application does not invalidate tokens or session identifiers when an administrator account is deleted. An attacker who previously obtained a session identifier from the deleted account (e.g., through interception, leak, or other methods) can still use that session to perform any operations in the system. The system does not verify with each request whether the account associated with the session still exists and is active.

The attacker gains full administrative access to the application — can read, modify, and delete data, and perform any operations reserved for administrators. The confidentiality, integrity, and availability of the system are compromised.

Apply patches available from the vendor according to the references. As an interim workaround, it is recommended to enforce invalidation of all active sessions when deleting a user account and implement a mechanism to verify the existence and status of an account with each authenticated session request.

Mindskip xzs-mysql version 3.8