GitHub Advisoryadvisory · Packagist

GHSA-6657-9743-4mc6 Tribal Systems Zenario CMS vulnerable to Session Fixation

MEDIUM Published 2022-11-30 Modified 2022-12-06 Official page ↗
Aliases
CVE-2022-4231
Ecosystem
Packagist
Packages
tribalsystems/zenario
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-384
Reviewed
2022-12-05

Affected packages

• Packagist tribalsystems/zenario: <= 9.3.57595 (no fix yet)

Description

Tribal Systems Zenario CMS 9.3.57595 is vulnerable to session fixation. In Zenario CMS, the user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after user logout and login again into the application when "Remember me" option active. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with. The attack may be initiated remotely and an exploit has been disclosed.

Related

Alias · CVE (1)

  • CVE-2022-4231 A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References