Ignition CVE-2015-0993

MEDIUM

7PK - Security Features (CWE-254)

2015-04-03 ics-cert@hq.dhs.gov

Authentication Bypass Ignition

6.4

CVSS 2.0 · NVD

Share

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/Au:N/C:P/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:P/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

P

Integrity

P

Availability

None

Lifecycle Timeline

1

CVE Published

Apr 03, 2015 - 10:59 cve.org

MEDIUM 6.4

DescriptionCVE.org

Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation.

AnalysisAI

Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-254. Inductive Automation Ignition 7.7.2 does not terminate a session upon a logout action, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation. Affected products include: Inductiveautomation Ignition.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Ignition

View all

CVE-2021-3129 CRITICAL Act Now POC

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra

CVE-2022-35890 CRITICAL Act Now POC

An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Rated critical severity (C

CVE-2021-24220 CRITICAL Act Now POC

Thrive “Legacy” Rise by Thrive Themes WordPress theme before 2.0.0, Luxe by Thrive Themes WordPress theme before 2.0.0,

CVE-2022-36126 HIGH This Week POC

An issue was discovered in Inductive Automation Ignition before 7.9.20 and 8.x before 8.1.17. Rated high severity (CVSS

CVE-2022-1704 CRITICAL Act Now

Due to an XML external entity reference, the software parses XML in the backup/restore functionality without XML securit

CVE-2022-35869 CRITICAL Act Now

This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ig

CVE-2021-43996 CRITICAL Act Now

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can l

CVE-2020-13909 CRITICAL Act Now

The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env. Rated critical sever

CVE-2021-24219 MEDIUM This Month POC

The Thrive Optimize WordPress plugin before 1.4.13.3, Thrive Comments WordPress plugin before 1.4.15.3, Thrive Headline

CVE-2022-1264 HIGH This Week

The affected product may allow an attacker with access to the Ignition web configuration to run arbitrary code. Rated hi

CVE-2022-35873 HIGH This Week

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation I

CVE-2022-35872 HIGH This Week

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation I

Same weakness CWE-254 – 7PK - Security Features

View all

CVE-2015-1158 CRITICAL POC

CVE-2016-2296 CRITICAL POC

CVE-2016-2118 HIGH POC

CVE-2015-1793 MEDIUM POC

CVE-2015-3693 CRITICAL POC

CVE-2016-0128 MEDIUM

CVE-2016-10178 CRITICAL POC

CVE-2015-8286 CRITICAL POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2012-1723 CRITICAL POC

CVE-2017-10271 HIGH POC

CVE-2015-1427 CRITICAL POC

CVE-2025-3248 CRITICAL POC

Share

CVE-2015-0993 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy