Session Fixation in Cacti - #VU54527
Published: July 5, 2021
Vulnerability identifier: #VU54527
CSH Severity: Low
CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise victim's account.
The vulnerability exists due to software does not always invalidates session identifier after user logs out. A remote attacker can re-use the session ID to gain unauthorized access to the application.
Note, the vulnerability requites that cacti is installed on PHP 5.x.
Affected software
Cacti
Remediation
Install updates from vendor's website.
Cacti - update to 1.2.18