Description
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany HAWKI
Default version status: affected
versions before commit 146967faffected