CVE-2023-51772: oneidentity password_manager Insufficient Session Expiration

Vulnerability summary

CVE-2023-51772 is a high (CVSS 8.8) Insufficient Session Expiration vulnerability in oneidentity password_manager. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.6% of scored vulnerabilities.

Timeline

1. 25-12-2023
   PublishedVulnerability first disclosed.
2. 09-09-2024
   Last modifiedVulnerability information updated.

Description

One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."