Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bigfix_insights_for_vulnerability_remediation | Hcltech | 4.2 (including) | 4.2 (including) |
Potential Mitigations
References
- https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0127753