Description
Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by knowing their username.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dev Blog | Dev Blog | 1.0 | — |
Critical · 9.1
CVE-2023-6144
EUVD-2023-58398GHSA-w9wh-97qp-xq2v
Dev Blog v1.0 - ATO
Published Nov 20, 2023 · Updated Aug 2, 2024 · Assigned by Fluid Attacks