PT-2009-1606 · Mozilla · Mozilowiki

Published 2009-02-13 · Updated 2017-08-17 · CVE-2008-6131

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions moziloWiki versions 1.0.1 and earlier

Description The issue allows remote attackers to hijack web sessions. This is achieved by setting the PHPSESSID parameter.

Recommendations For versions 1.0.1 and earlier, consider regenerating and updating session IDs after a user logs in to prevent session fixation attacks. As a temporary workaround, restrict access to sensitive operations that rely on session IDs until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-6131

Affected Products

Mozilowiki

References · 7

• http://secunia.com/advisories/32024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-6131 · Security Note
• http://wiki.mozilo.de/index.php?page=Changelog · Note
• http://securityfocus.com/bid/31493 · Note
• http://marc.info/?l=bugtraq&m=122278832621348&w=2 · Note
• http://majorsecurity.de/index_2.php?major_rls=major_rls56 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45528 · Note