PT-2017-9715 · Red Hat+1 · Ipsilon+2

Howard Johnson + 1 · Publicado 2016-11-21 · Atualizado 2023-02-12 · CVE-2016-8638

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions ipsilon versions 1.0 through 1.0.2 ipsilon versions 1.1 through 1.1.1 ipsilon versions 1.2 through 1.2.0 ipsilon versions 2.0 through 2.0.1

Description A issue was found that allows an attacker to log out active sessions of other users. This is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also referred to as a "SAML2 multi-session" issue.

Recommendations For ipsilon versions 1.0 through 1.0.2, update to version 1.0.3 or later. For ipsilon versions 1.1 through 1.1.1, update to version 1.1.2 or later. For ipsilon versions 1.2 through 1.2.0, update to version 1.2.1 or later. For ipsilon versions 2.0 through 2.0.1, update to version 2.0.2 or later.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CESA-2016_2809

CVE-2016-8638

GHSA-376M-3RM2-9JM6

RHSA-2016:2809

RHSA-2016_2809

Produtos afetados

Centos

Red Hat

Ipsilon

Referências · 17

• https://github.com/ipsilon-project/ipsilon · Nota
• https://github.com/ipsilon-project/ipsilon/commit/a33303b6beb5c316d7c18b23566b7666a4e307a4 · Nota
• https://github.com/ipsilon-project/ipsilon/commit/64fc366c054fc6af1d9d2692902db169884b5f78 · Nota
• https://github.com/ipsilon-project/ipsilon/commit/b4744a92d4fa7f6d7ade0ae2d99a2dc0ea94734d · Nota
• https://github.com/ipsilon-project/ipsilon/commit/1c48414877fc110652b6078a29529972c7ec9122 · Nota
• https://ipsilon-project.org/release/2.1.0.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-8638 · Nota de Segurança
• http://securityfocus.com/bid/94439 · Nota
• http://rhn.redhat.com/errata/RHSA-2016-2809.html · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-376m-3rm2-9jm6 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638 · Nota
• https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461c · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2016-8638 · Nota
• https://access.redhat.com/errata/RHSA-2016:2809 · Nota
• https://ipsilon-project.org/advisory/CVE-2016-8638.txt · Aviso do Fabricante