This vulnerability (CVE-2024-0947) in Talya Informatics Elektraweb is due to improper handling of cookies, specifically the lack of validation and integrity checks on session cookies. This weakness enables attackers to manipulate cookies or opaque client-side tokens to falsify session credentials, potentially gaining unauthorized access to the application. The issue affects versions before 17.0.68. The CVSS 3.1 base score of 9.8 reflects network attack vector, low attack complexity, no privileges or user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to falsify session credentials, enabling unauthorized access to user sessions and potentially full control over the affected application. This compromises confidentiality, integrity, and availability of the system. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been announced, users should monitor Talya Informatics communications for updates. Until a patch is available, consider restricting access to the affected versions and applying compensating controls if possible.