PT-2017-12808 · Apache · Apache2Triad

Hyp3Rlinx + 1 · Publicado 2017-08-23 · Atualizado 2019-05-06 · CVE-2017-12965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache2Triad version 1.5.4

Description A session fixation issue allows remote attackers to hijack web sessions via the PHPSESSID parameter.

Recommendations For Apache2Triad version 1.5.4, consider restricting access to the PHPSESSID parameter to minimize the risk of session hijacking until a patch is available.

Exploit

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2017-12965

Produtos afetados

Apache2Triad

Referências · 6

• 🔥 https://exploit-db.com/exploits/42520 · Exploit
• 🔥 http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12965 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-12965 · Aviso do Fabricante
• http://securityfocus.com/bid/100447 · Nota