CVE-2020-9449

Published: Feb 28, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

An insecure random number generation vulnerability in BlaB! AX, BlaB! AX Pro, BlaB! WS (client), and BlaB! WS Pro (client) version 19.11 allows an attacker (with a guest or user session cookie) to escalate privileges by retrieving the cookie salt value and creating a valid session cookie for an arbitrary user or admin.

Affected (4)

Products: Justblab: Blab! Ax, Blab! Ax Pro, Blab! Ws, Blab! Ws Pro

4 products

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Justblab Blab! Ax	Version 19.11
Justblab Blab! Ax Pro	Version 19.11
Justblab Blab! Ws	Version 19.11
Justblab Blab! Ws Pro	Version 19.11

Related CWEs

Use of Insufficiently Random Values

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

References (2)

https://justblab.com/latest-news

Source: cve@mitre.org

Vendor Advisory

https://justblab.com/latest-news

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.