CyberRota Analysis
AI-GeneratedPrior to version 0.9.21, CrossWatch's synchronization engine exposes sensitive session metadata through an unauthenticated API endpoint, allowing attackers to access information such as IP addresses, User-Agent strings, and session IDs. This vulnerability poses a medium risk as it enables unauthorized users to enumerate active sessions, potentially leading to further exploitation. Organizations using affected versions should prioritize upgrading to version 0.9.21 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.