CVE Vulnerabilities

CVE-2018-11475

Session Fixation

Published: May 25, 2018 | Modified: Nov 21, 2024
CVSS 3.x
8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
6 MEDIUM
AV:N/AC:M/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Monstra CMS 3.0.4 has a Session Management Issue in the Users tab. A password change at users/1/edit does not invalidate a session that is open in a different browser.

Weakness

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Affected Software

Name Vendor Start Version End Version
Monstra Monstra 3.0.4 (including) 3.0.4 (including)

Extended Description

Such a scenario is commonly observed when:

Potential Mitigations

References