CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.0 are vulnerable to session hijacking due to the HTTP /rpc sessions method exposing session UUIDs without authentication and lacking ownership verification for session fields. This allows unauthenticated attackers to enumerate session UUIDs, impersonate legitimate users, and gain unauthorized access to sensitive data, potentially leading to privilege escalation. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data manipulation and access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)