Gatemanager
Monthly
Session fixation in the Secomea GateManager webserver module lets an attacker who can plant a known session identifier on a victim's browser inherit that victim's authenticated session once they log in, yielding full control of the appliance's administrative web interface. Affected builds are GateManager 11.5 and 11.4.625515072; the vendor has released fixes in 11.6 and 11.4.626194074 and above. The flaw is remote and requires no prior authentication (CVSS 8.3, AV:N/PR:N), but does require victim interaction (UI:R) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
An improper authentication vulnerability in Secomea GateManager's webserver modules allows authenticated users to bypass authentication controls and access resources they should not be permitted to access. This affects GateManager version 11.4.0 and potentially other versions within the 11.4 release line. An attacker with valid login credentials can exploit this flaw to gain unauthorized access to sensitive information, achieving high confidentiality impact without modifying data or degrading availability.
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Session fixation in the Secomea GateManager webserver module lets an attacker who can plant a known session identifier on a victim's browser inherit that victim's authenticated session once they log in, yielding full control of the appliance's administrative web interface. Affected builds are GateManager 11.5 and 11.4.625515072; the vendor has released fixes in 11.6 and 11.4.626194074 and above. The flaw is remote and requires no prior authentication (CVSS 8.3, AV:N/PR:N), but does require victim interaction (UI:R) and there is no CISA KEV listing or public exploit code identified at time of analysis.
Privilege escalation in Secomea GateManager 11.5 and 11.4.625515072 allows an authenticated, low-privileged user (CVSS PR:L) to reach data or functionality that should be reserved for higher-privileged roles, resulting in a high confidentiality impact (C:H/I:N/A:N). Secomea has released fixed builds — 11.6 and 11.4.626194074 or later — and the flaw is rooted in CWE-280, improper handling of insufficient permissions or privileges. No public exploit code or CISA KEV entry has been identified in the supplied intelligence, and no EPSS score was provided, so real-world exploitation activity is currently unconfirmed.
An improper authentication vulnerability in Secomea GateManager's webserver modules allows authenticated users to bypass authentication controls and access resources they should not be permitted to access. This affects GateManager version 11.4.0 and potentially other versions within the 11.4 release line. An attacker with valid login credentials can exploit this flaw to gain unauthorized access to sensitive information, achieving high confidentiality impact without modifying data or degrading availability.
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.