CVE-2023-45687

A session fixation vulnerability in South River Technologies Titan MFT and Titan SFTP servers on Linux and Windows allows an attacker to bypass the servers authentication if they can trick an administrator into authorizating a session id of their choosing

Weakness

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Affected Software

Extended Description

Such a scenario is commonly observed when:

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/196.html
• https://cwe.mitre.org/data/definitions/21.html
• https://cwe.mitre.org/data/definitions/31.html
• https://cwe.mitre.org/data/definitions/39.html
• https://cwe.mitre.org/data/definitions/59.html
• https://cwe.mitre.org/data/definitions/60.html
• https://cwe.mitre.org/data/definitions/61.html

References

• https://helpdesk.southrivertech.com/portal/en/kb/articles/security-patch-for-issues-cve-2023-45685-through-cve-2023-45690
• https://www.rapid7.com/blog/post/2023/10/16/multiple-vulnerabilities-in-south-river-technologies-titan-mft-and-titan-sftp-fixed/