Session Fixation in Drupal - #VU545

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU545

Session Fixation in Drupal - #VU545

Published: September 20, 2016 / Updated: September 20, 2016


Vulnerability identifier: #VU545
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: N/A
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: Drupal
Affected software:
Drupal

Detailed vulnerability description

The vulnerability allows a remote user to access other users' initial session ID.
The weakness is caused by problems with users' session regeneration during a login event. After victim's authentication attackers may use the 'fixed' session ID that allows him to obtain valid user's session.
Successful exploitation of the vulnerability results in getting access to another user's session.

Remediation


Sources