In UBIKA WAAP Gateway/Cloud up to and including 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
ubikasec waap gateway |
||
ubikasec waap cloud |
||
ubikasec waap gateway 6.5.6 |
||
ubikasec waap cloud 6.5.6 |
Vulmon