| Package | Affected versions | Patched versions |
|---|---|---|
| waap cloud | = 6.5.6< 6.11.0< 6.5.6 | 6.11.06.5.6 |
| waap gateway | = 6.5.6< 6.11.0< 6.5.6 | 6.11.06.5.6 |
In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free