CVE-2024-4447
First published: Fri Jul 26 2024(Updated: )
In the System ? Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack this privilege would still be able to utilize the session IDs to imitate other users. While this is a very small attack vector that requires very high permissions to execute, its danger lies principally in obfuscating attribution; all Sign In As operations are attributed appropriately in the log files, and a malicious administrator could use this information to render their dealings untraceable — including those admins who have not been granted this ability — such as by using a session ID to generate an API token. Fixed in: 24.07.12 / 23.01.20 LTS / 23.10.24v13 LTS / 24.04.24v5 LTS
Credit: security@dotcms.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Unknown Unknown | <24.07.12<23.01.20>=23.10.24v13<24.04.24v5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4447?
CVE-2024-4447 is rated as a high-severity vulnerability due to unauthorized access to session ID information.
How do I fix CVE-2024-4447?
To fix CVE-2024-4447, ensure that only authorized admin users have access to the Logged Users tab in the System Maintenance tool.
What causes the vulnerability in CVE-2024-4447?
CVE-2024-4447 is caused by improper access controls that allow non-admin users to view sensitive session ID data.
Who is affected by CVE-2024-4447?
CVE-2024-4447 affects systems using versions prior to 24.07.12 and those within the specific version ranges mentioned.
What data is exposed by CVE-2024-4447?
CVE-2024-4447 exposes session ID data for all users through the Direct Web Remoting API.
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/severity
- agent/author
- agent/event
- agent/description
- collector/nvd-api
- source/NVD
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/unknown
- canonical/unknown unknown