Description (CNA)
If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| wibu-systems-ag / codemeter-runtime | affected 9.00 before 9.10; affected 8.00 before 8.41a; affected 7.00; affected 6.00 |
CWE
CWE-639
References
ADP enrichment
No English description supplied.
No references supplied.