If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | CHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | NONE |
Source: 2fc02b1f-71e7-4514-a878-169626f68903
Type: Secondary
Exploitability Score: 3.1
Impact Score: 4.0
| Source | Type | Description |
|---|---|---|
| 2fc02b1f-71e7-4514-a878-169626f68903 | Secondary |
en
CWE-639
|