CVE-2021-41553: Critical severity Archibus Web Central vulnerability
UNSUPPORTED WHEN ASSIGNED In ARCHIBUS Web Central 21.3.3.815 (a version from 2014), the Web Application in /archibus/login.axvw assign a session token that could be already in use by another user. It was therefore possible to access the application through a user whose credentials were not known, without any attempt by the testers to modify the application logic. It is also possible to set the value of the session token, client-side, simply by making an unauthenticated GET Request to the Home Page and adding an arbitrary value to the JSESSIONID field. The application, following the login, does not assign a new token, continuing to keep the inserted one, as the identifier of the entire session. This is fixed in all recent versions, such as version 26. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Version 21.3 was officially de-supported by the end of 2020.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ARCHIBUS Web Centralto a version that resolves this vulnerability.Fixed in 26 - Compensating control
For unsupported ARCHIBUS Web Central versions (e.g., 21.3.3.815), restrict access to the ARCHIBUS Web Central application so unauthenticated users cannot make requests that set an arbitrary JSESSIONID via the Home Page and obtain access using an existing/guessed session identifier.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41553?
CVE-2021-41553 has a severity rating that indicates potential serious security risks due to session fixation vulnerabilities.
How do I fix CVE-2021-41553?
To fix CVE-2021-41553, upgrade to a supported version of Archibus Web Central that corrects the session token assignment issue.
What are the potential impacts of CVE-2021-41553?
The potential impacts of CVE-2021-41553 include unauthorized access to user accounts and exposure of sensitive data.
Which version of Archibus Web Central is affected by CVE-2021-41553?
CVE-2021-41553 affects Archibus Web Central version 21.3.3.815.
Is there a workaround for CVE-2021-41553?
There are no known workarounds for CVE-2021-41553; upgrading is the recommended approach.