medium5.3Public exploit code
CVE-2023-38357
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- RWS WorldServer 11.7.3 - Session Token Enumeration2023-07-20 · webapps · multiple
Impact
Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessions.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rws | Worldserver | before 11.8.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/173609/RWS-WorldServer-11.7.3-Session-Token-Enumeration.html
- http://seclists.org/fulldisclosure/2023/Jul/30
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-001/-session-token-enumeration-in-rws-worldserver
- http://packetstormsecurity.com/files/173609/RWS-WorldServer-11.7.3-Session-Token-Enumeration.html
- http://seclists.org/fulldisclosure/2023/Jul/30
- https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-001/-session-token-enumeration-in-rws-worldserver