Session Fixation in passport - CVE-2022-25896

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU66181

Session Fixation in passport - CVE-2022-25896

Published: August 8, 2022


Vulnerability identifier: #VU66181
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-25896
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the session is regenerated instead of being closed when a user logs in or logs out. A remote attacker can gain access to the session.


Affected software

passport
IBM Security Verify Information Queue
IBM Cloud Pak for Watson AIOps
IBM Cloud Pak for Multicloud Management
Red Hat Advanced Cluster Management for Kubernetes
IBM Cloud Pak for Business Automation
Netcool Operations Insight
IBM Maximo Application Suite
strapi
Cloud Pak for Data

How to mitigate CVE-2022-25896

Install updates from vendor's website.

passport - update to 0.6.0
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Red Hat Advanced Cluster Management for Kubernetes - update to 2.6.2
strapi - update to 4.3.0
IBM Security Verify Information Queue - update to 10.0.5
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.26, 23.0.1.4
Netcool Operations Insight - update to 1.6.8
IBM Cloud Pak for Watson AIOps - update to 4.4.0
Cloud Pak for Data - update to 4.8.5
IBM Maximo Application Suite - addressed in versions 8.8.6, 8.9.2

External References

Related Security Bulletins