CVE-2016-8638
CriticalSummary
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 allows an attacker to log out active sessions of other users. This issue is related to how it tracks sessions and allows an unauthenticated attacker to view and terminate active sessions from other users.
Risk Assessment
The organization may be exposed to loss of control over user sessions, potentially leading to unauthorized access to data and resources.
Recommendation
It is recommended to update ipsilon to the latest version to mitigate this vulnerability and implement additional measures to secure user sessions.
Original NVD description (English source)
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."