exploitDog

CVE-2025-56746

Опубликовано: 15 окт. 2025

Источник: nvd

CVSS3: 2.2

EPSS Низкий

Описание

Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.

Ссылки

https://suryadina.com/academy-lms-session-fixation-1t8v5n3q6h/
Exploit
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:creativeitem:academy_lms:*:*:*:*:*:*:*:*

Версия до 5.13 (включая)

EPSS

Процентиль: 5%

0.0002

Низкий

2.2 Low

CVSS3

Дефекты

CWE-384

Связанные уязвимости

GHSA-j744-6rwf-chf5

CVSS3: 2.2

github

4 месяца назад

Creativeitem Academy LMS up to and including 5.13 does not regenerate session IDs upon successful authentication, enabling session fixation attacks where attackers can hijack user sessions by predetermining session identifiers.

EPSS

Процентиль: 5%

0.0002

Низкий

2.2 Low

CVSS3

Дефекты

CWE-384