PT-2022-18369 · Gibbon · Gibbon

Kole Swesey · Published 2022-05-25 · Updated 2022-06-08 · CVE-2022-27305

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gibbon version v23

Description The issue arises because the application does not generate a new session ID cookie after a user authenticates, making it susceptible to session fixation.

Recommendations For version v23, regenerate a new session ID cookie after user authentication to prevent session fixation.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-27305

GHSA-4MQ5-8JVH-QQ3P

Affected Products

Gibbon

References · 5

• https://github.com/GibbonEdu/core/security/advisories/GHSA-4mq5-8jvh-qq3p · Patch
• https://osv.dev/vulnerability/CVE-2022-27305 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27305 · Security Note
• http://gibbonedu.com · Note
• http://gibbon.com · Note