Description
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other session information is stored. Therefore, it is possible to spoof the IP address of a logged-in user to gain access to the Access Manager web interface.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
dormakaba Access Manager 92xx-k5
Default version status: unaffected
92xx-K5: <XAMB 04.06.212affected
dormakaba Access Manager 92xx-k7
Default version status: unaffected
92xx-K7: <BAME 04.07.268affected