CVE-2017-14013

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or assume the identity of an authenticated user.

A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or assume the identity of an authenticated user.

Un problema de cumplimiento del lado del cliente de la seguridad del lado del servidor se ha descubierto en la interfaz web de ProMinent MultiFLEX M10a Controller. La función log out en la aplicación elimina la sesión de usuario solo del lado del cliente. Esto podría permitir que un atacante omita los mecanismos de protección, obtener privilegios o asumir la identidad de un usuario autenticado.