Description
An attacker who can spoof the IP address and the User-Agent of a logged-in user can takeover the session because of flaws in the self-developed session management. If two users access the web interface from the same IP they are logged in as the other user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Image Access | Scan2Net | ≤ 7.42B | — |
References
- https://r.sec-consult.com/imageaccess third-party-advisory
- https://www.imageaccess.de/?page=SupportPortal&lang=en patch