Unscored CVE-2014-10400 EUVD-2014-1171GHSA-cj22-pqgj-4mxv

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID a…

Published Feb 6, 2020 · Updated Aug 6, 2024 · Assigned by mitre

Description

The session.lua library in CGILua 5.0.x uses sequential session IDs, which makes it easier for remote attackers to predict the session ID and hijack arbitrary sessions. NOTE: this vulnerability was SPLIT from CVE-2014-2875.

References

http://seclists.org/fulldisclosure/2014/Apr/318
http://www.securityfocus.com/archive/1/531981/100/0/threaded
http://www.syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid