CVE-2020-9449

An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 allows an attacker (with a guest or user session cookie) to escalate privileges by retrieving the cookie salt value and creating a valid session cookie for an arbitrary user or admin.

Score

CVSS 3.1 8.8 High

Status

Modified - cve@mitre.org

Published

2020-02-28

Last modified

2024-08-04

Weaknesses

CWE-330

Affected products

• Blab! Ax (Justblab)
• Blab! Ax Pro (Justblab)
• Blab! Ws (Justblab)
• Blab! Ws Pro (Justblab)

References

• https://justblab.com/latest-news