Non évaluée
Session Fixation
CVE-2024-25977
Première détection SecPulse
Description d'origine La description telle que publiée par la source (souvent en anglais).
The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser (e.g. via XSS) and prompt the victim to log in (e.g. via a redirect to the login page). This results in the victim's account being taken over.
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory r.sec-consult.com
- package github.com
- patch github.com
- web seclists.org