PT-2022-16701 · Silverstripe · Silverstripe/Framework

Kartik Patel · Published 2022-06-28 · Updated 2024-03-06 · CVE-2022-24444

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/framework versions 4.10 and earlier

Description The issue allows session fixation, where unexpired SessionIDs of logged out users can still be used to make authenticated requests when the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk.

Recommendations For Silverstripe silverstripe/framework versions 4.10 and earlier, consider disabling the hybridsessions module until a patch is available, or ensure the session-manager module is installed to mitigate the risk of session fixation. Restrict access to session IDs saved to disk to minimize the risk of exploitation.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BIT-SILVERSTRIPE-2022-24444

CVE-2022-24444

GHSA-C7Q8-M4XW-C674

Affected Products

Silverstripe/Framework

References · 12

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/hybridsessions/CVE-2022-24444.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-24444 · Security Note
• https://silverstripe.org/download/security-releases/cve-2022-24444 · Vendor Advisory
• https://forum.silverstripe.org/c/releases · Vendor Advisory
• https://silverstripe.org/download/security-releases · Vendor Advisory
• https://silverstripe.org/blog/tag/release · Vendor Advisory
• https://docs.silverstripe.org/en/4/changelogs/4.10.1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c7q8-m4xw-c674 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-silverstripe-2022-24444 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24444 · Vendor Advisory
• https://t.me/cibsecurity/45340 · Telegram Post
• https://t.me/cvenotify/32330 · Telegram Post