syslink Software AG Avantra Insufficient Session Expiration Vulnerability Allowing Session Replay

A vulnerability exists in syslink Software AG Avantra on Linux and Windows platforms, prior to version 25.3.1, due to insufficient session expiration. This flaw allows for session ID reuse, commonly referred to as session replay.

Impact

Exploitation of this vulnerability could lead to unauthorized reuse of session IDs, allowing for session hijacking through session replay attacks.

Remediation

Users are advised to upgrade to version 25.3.1 or above. For those on version 25.1.x or earlier, disable the Web.http-server option in the Avantra Master settings and restart the Master. If on version 25.2.1 through 25.3.0, the Web.http-server toggle is unavailable; instead, firewall port 9058 or redirect the Web.http-port to a blocked port, then restart the Master. Users on version 25.3.1 or above need not take any action.