PT-2009-1439 · Impresscms · Impresscms

Published 2009-01-23 · Updated 2018-10-11 · CVE-2008-5964

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Social ImpressCMS versions prior to 1.1.1 RC1

Description A session fixation issue allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.

Recommendations For versions prior to 1.1.1 RC1, update to version 1.1.1 RC1 or later to resolve the issue.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-5964

Affected Products

Impresscms

References · 10

• http://secunia.com/advisories/32985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5964 · Security Note
• http://wiki.impresscms.org/index.php?title=Change_Log#2008-12-2_:_1.1.1_RC · Vendor Advisory
• http://sourceforge.net/forum/forum.php?forum_id=893767 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5964 · Note
• http://securityfocus.com/bid/32495 · Note
• http://securityfocus.com/archive/1/498734/100/0/threaded · Note
• http://securityfocus.com/archive/1/498885/100/0/threaded · Note
• http://osvdb.org/50413 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46989 · Note