A Weak Session Management vulnerability in Citadel WebCit through 926 allows unauthenticated remote attackers to hijack recently logged-in users sessions. NOTE: this was reported to the vendor in a publicly archived Multiple Security Vulnerabilities in WebCit 926 thread.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Webcit | Citadel | * | 926 (including) |
| Webcit | Ubuntu | bionic | * |
| Webcit | Ubuntu | groovy | * |
| Webcit | Ubuntu | trusty | * |
| Webcit | Ubuntu | xenial | * |