TI-2024-17075 Aliases CVE-2024-25977

Session Fixation

LOW 33CWE-384Published 2024-05-29 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-384.

Summary

The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00569 47th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Interaction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany	HAWKI	versions before commit 146967f and later	—	No fix listed	CNA

HAWKI VendorInteraction Design Team at the University of Applied Sciences and Arts in Hildesheim/Germany Affected versions before commit 146967f and later Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-25977

References

TI-2024-17073 Arbitrary File Overwrite CVSS 3.1MEDIUM 6.5
TI-2024-17074 Reflected cross-site-scripting (XSS) in Interaction Design Team at the University of… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences