Thinfinity Workspace Multiple CVEs Advisory: Session Hijacking, Bypass, Hardcoded Keys (CVE-2024-40404/40408/40410/40407/40405)

From this webpage screenshot, the following key information about the vulnerabilities can be obtained: 1. Vulnerability Identification: - CVE IDs: CVE-2024-40404, CVE-2024-40408, CVE-2024-40410, CVE-2024-40407, CVE-2024-40405 - Affected Versions: Thinfinity Workspace < 7.0.2.113 - CVSS Scores: 9.8, 7.3, 4.7, 7.5, 8.1 - Descriptions: - CVE-2024-40404: Allows malicious attackers to intercept and obtain user sessions via WebSocket connections. - CVE-2024-40408: Due to insufficient access controls, attackers can bypass security, create profiles without authorization, and access resources. - CVE-2024-40410: Hardcoded encryption key in the WebDAV component may compromise the integrity and confidentiality of JWT tokens. - CVE-2024-40407: Allows authenticated attackers to access the root path of the software. - CVE-2024-40405: Remote applications accessible across multiple proxies with restricted user access can be exploited by modifying request data, enabling unauthorized access to applications of another proxy. 2. Update Recommendations: - All users are advised to upgrade to version v7.0.3.109 or higher. - Customers are encouraged to upgrade directly to Thinfinity Workspace v8.0.0.101, the latest released version. - Version 8.0.0.101 includes comprehensive fixes for the identified issues and introduces new security enhancements and features to improve overall performance and protection. 3. Additional Information: - For more information about the latest version, visit the Thinfinity Workspace update page. - If assistance with upgrading is needed, the support team can provide help to ensure a smooth transition to the latest version. This information is critical for understanding the security vulnerabilities in Thinfinity Workspace and the recommended remediation actions.

Goal Reached Thanks to every supporter — we hit 100%!

Thinfinity Workspace Multiple CVEs Advisory: Session Hijacking, Bypass, Hardcoded Keys (CVE-2024-40404/40408/40410/40407/40405)