CVEvulnerability
CVE-2022-44007
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-11-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-384
Description
An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation.
Affected configurations
• backclick backclick 5.9.63
Related
Weakness · CWE (1)
- CWE-384 Session Fixation weakness
References
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt Exploit, Third Party Advisory
- https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 Third Party Advisory
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt Exploit, Third Party Advisory
- https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 Third Party Advisory