CWE:

	Topic	Date	Author
Low	OpenVPN Access Server 2.1.4 CRLF Injection	27.05.2017	SYSDREAM
Med.	Horsys v8 multiple vulnerabilities	23.06.2016	Florian Nivette
Med.	FancyFon FAMOC 3.16.5 Session Fixation	28.01.2015	Matthias Deeg
Med.	Jasper Server 5.5 Session Fixation	11.05.2014	Felipe Andrian Peixoto

---

CVEMAP Search Results

CVE

Details

Description

2023-10-09

CVE-2023-44400

Updating...

Uptime Kuma is a self-hosted monitoring tool. Prior to version 1.23.3, attackers with access to a user's device can gain persistent account access. This is caused by missing verification of Session Tokens after password changes and/or elapsed inactivity periods. Version 1.23.3 has a patch for the issue.

2023-08-31

CVE-2023-4649

Updating...

Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

2023-08-23

CVE-2023-40273

Updating...

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that). With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour. Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability.

2023-06-23

CVE-2023-3394

Updating...

Session Fixation in GitHub repository fossbilling/fossbilling prior to 0.5.1.

2023-06-11

CVE-2023-3192

Updating...

Session Fixation in GitHub repository froxlor/froxlor prior to 2.1.0.

2023-04-21

CVE-2023-29019

Updating...

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.

2023-04-15

CVE-2023-2105

Updating...

Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

2023-02-03

CVE-2022-24895

Updating...

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation. This issue has been fixed in the 4.4 branch.

2023-01-10

CVE-2023-22479

Updating...

KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible. A patch will be released in version 1.6.4.

2023-01-06

CVE-2014-125048

Updating...

A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The name of the patch is e9f0d509e1408743048e29d9c099d36e0e1f6ae7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217559.

 

---

Copyright 2023, cxsecurity.com