PT-2018-12481 · Wondercms · Wondercms

Anusya Angamuthu · Published 2018-07-18 · Updated 2018-09-19 · CVE-2018-14387

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WonderCMS versions prior to 2.5.2

Description An issue allows an attacker to create a new session on a web application, record the associated session identifier, and then cause the victim to authenticate against the server using the same session identifier. This enables the attacker to access the user's account through the active session. The attack fixes a session on the victim's browser before the user logs in.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2018-14387

Affected Products

Wondercms

References · 4

• 🔥 https://github.com/robiso/wondercms/issues/64 · Exploit
• https://wondercms.com/whatsnew · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-14387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14387 · Security Note