PT-2017-12808 · Apache · Apache2Triad

Hyp3Rlinx + 1 · Published 2017-08-23 · Updated 2019-05-06 · CVE-2017-12965

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache2Triad version 1.5.4

Description A session fixation issue allows remote attackers to hijack web sessions via the PHPSESSID parameter.

Recommendations For Apache2Triad version 1.5.4, consider restricting access to the PHPSESSID parameter to minimize the risk of session hijacking until a patch is available.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2017-12965

Affected Products

Apache2Triad

References · 6

• 🔥 https://exploit-db.com/exploits/42520 · Exploit
• 🔥 http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12965 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12965 · Vendor Advisory
• http://securityfocus.com/bid/100447 · Note