The RDPData.dll file exposes the /irmdata/api/common endpoint that handles session IDs, among other features. By using a UNION SQL operator, an attacker can leak the sessions table, obtain the currently valid sessions and impersonate a currently logged-in user.
Metrics
Affected Vendors & Products
References
History
Thu, 26 Sep 2024 20:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: Bitdefender
Published: 2023-09-07T12:24:41.564Z
Updated: 2024-09-26T19:12:27.878Z
Reserved: 2023-08-01T15:26:26.149Z
Link: CVE-2023-39423
Vulnrichment
Updated: 2024-08-02T18:10:21.063Z
NVD
Status : Modified
Published: 2023-09-07T13:15:08.837
Modified: 2024-11-21T08:15:23.907
Link: CVE-2023-39423
Redhat
No data.