CVE-2024-42345: siemens sinema_remote_connect_server Session Fixation

Vulnerability summary

CVE-2024-42345 is a medium (CVSS 5.3) Session Fixation vulnerability in siemens sinema_remote_connect_server. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26% of scored vulnerabilities.

Timeline

1. 10-09-2024
   PublishedVulnerability first disclosed.
2. 10-09-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP2). The affected application does not properly handle user session establishment and invalidation. This could allow a remote attacker to circumvent the additional multi factor authentication for user session establishment.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.