CVE-2024-8643

Session Fixation is when an attacker is able to impose a pre-known session identifier on a victim, and the application accepts it without generating a new token after login. When the user authenticates using the previously established identifier, the attacker can use the same identifier to gain access to the victim's session. The vulnerability can be further exploited to conduct Brute Force attacks on session tokens or Session Hijacking.

An attacker can fully hijack the session of an authenticated user, gaining unauthorized access to their account and data processed by the ValeApp application. Depending on the privileges of the hijacked account, it is possible to compromise the confidentiality, integrity, and availability of data.

ValeApp should be updated to version v2.0.0 or newer, in which the vulnerability has been fixed. It is also recommended to invalidate all active user sessions after implementing the update and to verify session management configuration in accordance with the manufacturer's guidelines available in the references.

Oceanicsoft ValeApp in all versions before v2.0.0.