PT-2012-3834

CVE-2012-2144

Publicado

2012-06-05

Atualizado

2022-05-17

Descrição por

CVSS 2.0

6.8

Média

MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions folsom-1 through 2012.1

Description A session fixation issue allows remote attackers to hijack web sessions via the sessionid cookie.

Recommendations For OpenStack Dashboard (Horizon) versions folsom-1 through 2012.1, consider regenerating session IDs after a user logs in to prevent session fixation attacks. As a temporary workaround, restrict access to sensitive operations that rely on session authentication until a patch is available.

Explorabilidade

Exploit

Correção

Impactos

Pesquisadores

Thomas Biege

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-384: Session Fixation

Identificadores relacionados

CVE-2012-2144