CVE Vulnerabilities

CVE-2014-10399

Session Fixation

Published: Feb 06, 2020 | Modified: Feb 11, 2020
CVSS 3.x
6.1
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

The session.lua library in CGILua 5.1.x uses the same ID for each session, which allows remote attackers to hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.

Weakness

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Affected Software

Name Vendor Start Version End Version
Cgilua Keplerproject 5.0.0 (including) 5.0.1 (including)
Cgilua Keplerproject 5.1.0 (including) 5.1.4 (including)
Cgilua Keplerproject 5.2-alpha1 (including) 5.2-alpha1 (including)
Cgilua Keplerproject 5.2-alpha2 (including) 5.2-alpha2 (including)

Extended Description

Such a scenario is commonly observed when:

Potential Mitigations

References