CVE-2024-11317

Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product.  Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

Scoring

Severity

CRITICAL

CVSS base score

10

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:L

EPSS probability

0.43%

CWE

CWE-384

Published

2024-12-05

Last modified

2026-03-13

Affected products

• ABB ASPECT-Enterprise
• ABB NEXUS Series
• ABB MATRIX Series

Weakness type

• CWE-384

Related vulnerabilities

• CVE-2024-38513 — Fiber Session Middleware Token Injection Vulnerability
• CVE-2025-59841 — FlagForgeCTF's Improper Session Handling Allows Access After Logout
• CVE-2025-52689 — Weak Session ID Check in the OmniAccess Stellar Web Management Interface
• CVE-2024-13967 — ession-Management Failure
• CVE-2024-45368 — AutomationDirect DirectLogic H2-DM1E Session Fixation
• CVE-2022-30605 — A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f
• CVE-2020-25198 — MOXA NPort IAW5000A-I/O Series
• CVE-2026-22082 — Insecure Session ID Management Vulnerability in Tenda Wireless Routers

Markdown version · Browse all CVEs