PT-2009-1606 · Mozilla · Mozilowiki

Publicado 2009-02-13 · Atualizado 2017-08-17 · CVE-2008-6131

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions moziloWiki versions 1.0.1 and earlier

Description The issue allows remote attackers to hijack web sessions. This is achieved by setting the PHPSESSID parameter.

Recommendations For versions 1.0.1 and earlier, consider regenerating and updating session IDs after a user logs in to prevent session fixation attacks. As a temporary workaround, restrict access to sensitive operations that rely on session IDs until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2008-6131

Produtos afetados

Mozilowiki

Referências · 7

• http://wiki.mozilo.de/index.php?page=Changelog · Nota
• http://secunia.com/advisories/32024 · Aviso do Fabricante
• http://securityfocus.com/bid/31493 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-6131 · Nota de Segurança
• http://marc.info/?l=bugtraq&m=122278832621348&w=2 · Nota
• http://majorsecurity.de/index_2.php?major_rls=major_rls56 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45528 · Nota