Session Fixation in Drupal Drupal

1) Session Fixation

EUVDB-ID: #VU542

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to access other users' initial session ID.
The weakness is caused by problems with users' session regeneration. After victim's authentication attackers may use the 'fixed' session ID that allows him to obtain valid user's session.
Successful exploitation of the vulnerability results in getting access to another user's session.

Mitigation

Update to 5.9.
http://ftp.drupal.org/files/projects/drupal-5.9.tar.gz

Vulnerable software versions

Drupal: 5.0 - 5.8

CPE2.3

• cpe:2.3:a:drupal:drupal:5.8:*:*:*:*:*:*:*

External links

http://www.drupal.org/node/286417

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.