Unrated
Session Fixation
CVE-2024-25977
First seen on SecPulse
Original description The description as published by the source.
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
References
- advisory github.com
- advisory nvd.nist.gov
- advisory r.sec-consult.com
- package github.com
- patch github.com
- web seclists.org