PSI Probe 5.3.0 allows remote attackers to bypass security controls

Summary

An attacker can remotely exploit a security weakness in PSI Probe version 5.3.0, which could allow them to bypass access controls. This could potentially lead to unauthorized access to sensitive information. Update to a fixed version of PSI Probe to protect against this vulnerability.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions	Fix available
psi-probe	psi_probe	<= 5.3.0	–

Original title

A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/RemoveSessAttribu...

Original description

A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/RemoveSessAttributeController.java of the component Session Attribute Handler. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

nvd CVSS2.0 5.5

nvd CVSS3.1 5.4

nvd CVSS4.0 5.3

Vulnerability type

CWE-266 Incorrect Privilege Assignment

CWE-284 Improper Access Control