Axxon One vulnerabilities

Use of Default Password (CWE-1393) in the web client in AxxonSoft Axxon One before 3.0.0 allows a remote unauthenticated attacker to log in as the built-in administrator with default credentials on a newly installed system, because the web client did not enforce the mandatory change of the default password on first login.

Plaintext storage of a password (CWE-256) in the SecurityManager shared configuration of AxxonSoft Axxon One before 3.1.0 allows a local attacker with read access to the configuration directory or backups to obtain the LDAP service account password from the main.conf file.

Exposure of sensitive information to an unauthorized actor (CWE-200) in the security configuration API of AxxonSoft Axxon One before 3.2.0 allows a remote authenticated low-privileged user to enumerate all configured users and roles, because the user configuration request returned complete lists regardless of the caller's permissions.

Insufficient Session Expiration in the Web Admin Panel in AxxonSoft Axxon One (C-Werk) prior to 2.0.3 on Windows allows an authenticated attacker to retain access with removed privileges via continued use of an unexpired session token until natural expiration.