docuFORM Managed Print Service Client CVE-2025-65415

The attack requires the victim to click a malicious link containing a session identifier before authenticating. The application must fail to regenerate session tokens after login, allowing the pre-set session ID to remain valid post-authentication. Exploitation is limited by the need for user interaction (UI:R in CVSS vector), meaning the attacker cannot exploit this remotely without social engineering. Authentication is not required from the attacker themselves, but the victim's subsequent authentication is necessary for the attack to grant meaningful access. The vulnerability affects the login page specifically, implying that only the authentication endpoint is susceptible to this session fixation vector.

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates low-to-moderate real-world exploitability: network accessibility and low attack complexity favor attackers, but the requirement for user interaction (UI:R) significantly reduces the practical attack surface compared to fully automated exploitation. The score of 5.4 places this in the 'medium' severity range, with impacts limited to partial confidentiality and integrity (reading some session data and performing limited unauthorized actions) without availability impact. Notably, no EPSS score, KEV status, POC availability, or vendor advisory with patch information has been provided in the source data. The absence of CISA KEV listing and confirmed POC suggests this is not currently a targeted or widespread exploitation vector, though the relatively straightforward nature of session fixation attacks (well-documented attack class) and the existence of a security researcher GitHub gist hint at technical feasibility. The limiting factor-user interaction requirement-means successful exploitation depends heavily on social engineering effectiveness. Without patch availability confirmation, defenders must rely on compensating controls and user awareness measures.

An attacker crafts a malicious URL containing a pre-set session ID parameter and tricks a user (via phishing email or social media) into clicking the link before logging in. The victim clicks the link, establishing the attacker's session ID in their browser. The victim then authenticates with their credentials using that same session ID. The attacker, knowing the session ID, can now access the authenticated session and view print jobs, user information, or perform unauthorized actions without possessing the victim's password.