CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
Blue Access Cobalt v02.000.195 suffers from an authentication bypass vulnerability, which allows an attacker to selectively proxy requests in order to operate functionality on the web application without the need to authenticate with legitimate credentials.
AnalysisAI
Blue Access Cobalt v02.000.195 has an authentication bypass through selective request proxying. Attackers can manipulate proxy behavior to access web application functions without legitimate credentials.
Technical ContextAI
The application's proxy mechanism can be manipulated (CWE-287) to forward requests to backend services without requiring authentication. By crafting requests that bypass the authentication proxy layer, attackers can access any application function directly.
RemediationAI
Update to a patched version. Ensure authentication is enforced at the application level, not just the proxy level.
Share
External POC / Exploit Code
Leaving vuln.today