Session hijacking in Red Hat Gluster Storage Web Administration and Red Hat Gluster Storage Server for On-premise - CVE-2018-1127
Published: September 4, 2018 / Updated: September 5, 2018
Vulnerability identifier: #VU14602
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-1127
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to conduct session fixation attack.
The vulnerability exists due to the 'tendrl-api' component does not properly remove session tokens when the target user logs out. A remote attacker can monitor session tokens can replay the tokens to hijack the target user's session.
Affected software
Red Hat Gluster Storage Web Administration
Red Hat Gluster Storage Server for On-premise
Red Hat Gluster Storage Server for On-premise
How to mitigate CVE-2018-1127
Install update from vendor's website.