Threats tagged 'ghsa-3jg2-q8pw-r325'

The Node.js web service on Versa Operating System (VOS) used for URL-based Zero Touch Provisioning (ZTP) generates session identifiers using UUID version 1, which are predictable due to their derivation from system date, time, and MAC address. This predictability allows an attacker to potentially hijack user sessions if the service remains enabled after provisioning. Versa recommends disabling this service post-provisioning to mitigate the risk. The vulnerability is not exploitable if the Node.js web service is disabled.