CVE-2024-25977 Information

Description

The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim’s browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim’s account being taken over.

Reference

https://r.sec-consult.com/hawki https://github.com/HAWK-Digital-Environments/HAWKI/commit/146967f3148e92d1640ffebc21d8914e2d7fb3f1