CVE-2018-18380

Опубликовано: 19 окт. 2018

Источник: nvd

CVSS3: 5.4

CVSS2: 5.8

EPSS Низкий

Описание

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session.

Ссылки

https://gist.github.com/zionspike/680eb504db7c86296fad0eff30c6317f
Patch
Third Party Advisory
https://github.com/bigtreecms/BigTree-CMS/commit/c69402c4764ed9a76301c57277aefe70141b6418
Patch
https://github.com/bigtreecms/BigTree-CMS/tree/4.2.24
Release Notes
https://gist.github.com/zionspike/680eb504db7c86296fad0eff30c6317f
Patch
Third Party Advisory
https://github.com/bigtreecms/BigTree-CMS/commit/c69402c4764ed9a76301c57277aefe70141b6418
Patch
https://github.com/bigtreecms/BigTree-CMS/tree/4.2.24
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bigtreecms:bigtree_cms:*:*:*:*:*:*:*:*

Версия до 4.2.24 (исключая)

EPSS

Процентиль: 46%

0.00236

Низкий

5.4 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-384

Связанные уязвимости

GHSA-qw2p-v864-678m