Aller au contenu
en Se connecter
5.3 Moyenne

CVE-2026-46544 Microsoft UFO open-source framework for intelligent automation across devices and platforms

Description

Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied session_id values in WebSocket task messages and reuses an existing in-memory session object if that session_id already exists. If a prior session has completed and remains in memory with populated results, a different authenticated client can send a new TASK message using the same session_id. The server re-enters the existing session object and sends the stale stored result to the new requester through the normal send_task_end() callback path. This is an authenticated cross-client stale result replay issue. The issue requires that the attacker knows or can predict a live or recently completed session_id.

Produits et versions touchés

Produit Versions touchées Corrigé en
UFO 3.0.1-4-ge2626659 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de UFO

Les 17 CVE de UFO →
CVE-2026-105793 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 9.1 Critique CVE-2026-105792 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 6.5 Moyenne CVE-2026-105791 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 7.5 Élevée CVE-2026-105790 Microsoft UFO is an open-source framework for intelligent automation across devices and platforms 6.4 Moyenne
Suivre cette CVE