PT-2024-40078 · Session · Session

Published 2024-05-27 · Updated 2024-05-27

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Session (affected versions not specified)

Description: A security protection mechanism in Session, designed to prevent session hijacking, was not functioning correctly. This mechanism aimed to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

GHSA-4QX8-J9VH-2628

Affected Products

Session

References · 6

• https://osv.dev/vulnerability/GHSA-4qx8-j9vh-2628 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/framework/SS-2017-006-1.yaml · Note
• https://github.com/silverstripe/silverstripe-framework/commit/44de03da0147e6094b02602b7b73d5b1a1306d78 · Note
• https://github.com/silverstripe/silverstripe-framework/commit/d47667bb0768841e4b305fa95d5a4e2ba232c4ad · Note
• https://github.com/silverstripe/silverstripe-framework · Note
• https://silverstripe.org/download/security-releases/ss-2017-006 · Note