Description
HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session identifier, send victims a crafted link containing it, and replay the identifier after the victim authenticates to hijack their account and access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| hubzero | hubzero-cms | ≤ 2.2.32 | — |
References
- Patch Commit patch
- https://github.com/hubzero/hubzero-cms product
- https://github.com/hubzero/hubzero-cms/blob/v2.2.32/core/libraries/Hubzero/Session/Manager.php#L123-L132 technical-description
- VulnCheck Advisory: HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier third-party-advisory