← Vulnerability feed

Vulnerability record · CVE-2017-6529 · published 9 March 2017

CVE-2017-6529: Dnatools dnalims insufficient session expiration vulnerability

Dnatools · Dnalims

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

8.8 CVSS 3.0 High EPSS 2.9% · top 13.6% CWE-613 · Insufficient session expiration
8.8CVSS 3.0 base score, v2 6.8
2.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/96823
https://www.exploit-db.com/exploits/41578/
https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ ExploitTechnical DescriptionThird Party Advisory
http://www.securityfocus.com/bid/96823
https://www.exploit-db.com/exploits/41578/
https://www.shorebreaksecurity.com/blog/product-security-advisory-psa0002-dnalims/ ExploitTechnical DescriptionThird Party Advisory

Track CVE-2017-6529 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-6526dnaLIMS unauthenticated command execution via admin web shelldnaTools dnaLIMS 4-2015s13 exposes an improperly protected administrative web shell at cgi-bin/dna/sysAdmin.cgi that accepts POST requests without au…EPSS 57%analysed8.1CVE-2017-6528Dnatools dnalims insufficiently protected credentials vulnerabilityAn issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is affected by plaintext password storage (the /home/dna/spool/.pfile file).EPSS 3.4%7.5CVE-2017-6527dnaLIMS directory traversal in viewAppletFsa.cgi seqID parameterdnaTools dnaLIMS 4-2015s13 is vulnerable to a NUL-terminated directory traversal attack via the seqID parameter of viewAppletFsa.cgi. An unauthentica…EPSS 57%analysed

Source: NIST National Vulnerability Database (record CVE-2017-6529), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.