PT-2019-18555 · Zoneminder+2 · Zoneminder+2

Publicado 2019-02-04 · Atualizado 2020-02-17 · CVE-2019-7350

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.32.3

Description The issue allows an attacker to fixate their own session cookies to the next logged-in user, resulting in the hijacking of the victim's account. This happens because multiple cookies are generated upon successful login, and these sets overlap for successive logins.

Recommendations For versions prior to 1.32.3, update to a version that contains a fix for this issue to prevent session fixation attacks.

Exploit

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

ALT-PU-2020-1092

ALT-PU-2020-1246

CVE-2019-7350

Produtos afetados

Alt Linux

Debian

Zoneminder

Referências · 8

• 🔥 https://github.com/ZoneMinder/zoneminder/issues/2471 · Exploit
• https://cve.org/CVERecord?id=CVE-2019-7350 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-7350 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7350 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-7350 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-7350 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7350 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7350 · Aviso do Fabricante