CVE-2025-71455: vtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as through cross-site scripting, can bypass the HttpOnly flag and hijack authenticated sessions.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must be able to execute script in the vtenext origin, such as by exploiting a cross-site scripting vulnerability. Exploitation also requires user interaction, as reflected by the UI:R vector.
Who is at risk?
Authenticated vtenext users are at risk of session hijacking if attacker-controlled script runs in the vtenext origin. The disclosed PHPSESSID value can allow the attacker to take over an authenticated session.
Does HttpOnly protect against this vulnerability?
No. The issue allows script executing in the vtenext origin to obtain the PHPSESSID value from the Touch web service endpoint, bypassing the intended protection of the HttpOnly flag.
What version should be used to remediate the issue?
Upgrade vtenext to version 25.02.2 or later. The vulnerability affects versions before 25.02.2.