PT-2022-26364 · Tribal Systems · Zenario Cms

Ngo Van Tu · Published 2022-11-30 · Updated 2022-12-06 · CVE-2022-4231

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tribal Systems Zenario CMS version 9.3.57595

Description The issue affects the Remember Me Handler component, leading to session fixation. This can be exploited remotely, and the exploit has been disclosed. The attack may be initiated by an attacker setting up a trap session on the device the victim is likely to login with, taking advantage of the fact that the user session identifier is not changed after user logout and login again when the "Remember me" option is active.

Recommendations For version 9.3.57595, consider disabling the "Remember me" option as a temporary workaround to minimize the risk of session fixation until a patch is available. Restrict access to the Remember Me Handler component to prevent potential exploitation.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-4231

GHSA-6657-9743-4MC6

Affected Products

Zenario Cms

References · 8

• 🔥 https://github.com/lithonn/bug-report/tree/main/vendors/tribalsystems/zenario/session-fixation · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4231 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4231 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6657-9743-4mc6 · Vendor Advisory
• https://github.com/TribalSystems/Zenario · Note
• https://vuldb.com/?id.214589 · Note
• https://t.me/cibsecurity/53709 · Telegram Post
• https://t.me/cvenotify/38779 · Telegram Post