PT-2017-6522 · Unknown · Rest-Client

Ab · Published 2015-05-15 · Updated 2018-08-13 · CVE-2015-1820

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rest-client versions 1.6.1.a through 1.8.0

Description The issue allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

Recommendations For versions 1.6.1.a through 1.7.x, update to version 1.8.0 or later to resolve the issue. For version 1.8.0, ensure you have the latest patch or update to prevent exploitation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2015-1820

GHSA-3FHF-6939-QG8P

MGASA-2015-0227

RHSA-2021:1313

Affected Products

Rest-Client

References · 20

• https://osv.dev/vulnerability/GHSA-3fhf-6939-qg8p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1820 · Security Note
• https://osv.dev/vulnerability/MGASA-2015-0227 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0227.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1820 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1820 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-1820 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1205291 · Patch
• https://ubuntu.com/security/CVE-2015-1820 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-1820 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-1820 · Security Note
• https://github.com/rest-client/rest-client/issues/369 · Note
• https://github.com/rest-client/rest-client · Note
• https://github.com/rest-client/rest-client/blob/master/history.md · Note
• https://web.archive.org/web/20200228080106/http://securityfocus.com/bid/73295 · Note