PT-2012-3834

CVE-2012-2144

Published

2012-06-05

Updated

2022-05-17

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Dashboard (Horizon) versions folsom-1 through 2012.1

Description A session fixation issue allows remote attackers to hijack web sessions via the sessionid cookie.

Recommendations For OpenStack Dashboard (Horizon) versions folsom-1 through 2012.1, consider regenerating session IDs after a user logs in to prevent session fixation attacks. As a temporary workaround, restrict access to sensitive operations that rely on session authentication until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Thomas Biege

Vendors

Affected products

Weakness enumeration

CWE-384: Session Fixation

Related identifiers

CVE-2012-2144