Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gibbon | Gibbonedu | * | 23.0.02 (excluding) |
Such a scenario is commonly observed when: