HCL OneTest Performance V9.5, V10.0, V10.1 contains an inadequate session timeout, which could allow an attacker time to guess and use a valid session ID.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Onetest_performance | Hcltechsw | 9.5.0 (including) | 9.5.0 (including) |
| Onetest_performance | Hcltechsw | 10.0.0 (including) | 10.0.0 (including) |
| Onetest_performance | Hcltechsw | 10.1.0 (including) | 10.1.0 (including) |