Threats tagged 'ghsa-q454-c9v2-qxv3'

The Node.js web service on Versa Operating System (VOS) appliances uses a hardcoded secret in its express-session middleware to sign session cookies. This secret is identical across all VOS appliances, allowing an attacker who obtains any valid session ID to forge session cookies accepted by any appliance in the deployment. The vulnerable service is intended only for initial Zero Touch Provisioning (ZTP) and should be disabled after provisioning. Devices with the Node.js web service disabled are not exploitable via this vulnerability.