GHSA-qpxw-6473-ppww CVE-2020-12467
Session Fixation in Subrion CMS
Medium
Packagist
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.94%
- Chance of exploitation in the next 30 days. Higher than 60.93% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-384 Session Fixation
- Fix
- None yet
- No fixed version published
Description
Subrion CMS 4.2.1 allows session fixation via an alphanumeric value in a session cookie.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| intelliants/subrion | <= 4.2.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-384: Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
How to prevent it
- Architecture and Design: Invalidate any existing session identifiers prior to authorizing a new user session.
- Architecture and Design: For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
- Operation: Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
References
Advisories
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-wrcg-234w-hfhq Subrion CMS vulnerable to Cross-site Scripting | Low | Also affects intelliants/subrion |
| GHSA-9jjm-mc56-3qxv Subrion CMS vulnerable to cross-site scripting | Medium | Also affects intelliants/subrion |
| GHSA-h8wv-vv58-468h Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool | Low | Also affects intelliants/subrion |
| GHSA-q4qh-8pxw-r48q Subrion CMS vulnerable to Cross Site Scripting | Medium | Also affects intelliants/subrion |
| GHSA-2x28-c7j7-23gv Subrion remote command execution vulnerability | High | Also affects intelliants/subrion |
| GHSA-646r-8fcc-p82r Subrion CMS vulnerable to Cross-site Scripting | Medium | Also affects intelliants/subrion |
| GHSA-7vff-rv2f-cj79 Subrion CMS Cross-site Scripting vulnerability | Medium | Also affects intelliants/subrion |
| GHSA-q832-2275-rfqh Subrion CMS XSS in /panel/configuration/financial/ | Medium | Also affects intelliants/subrion |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor