Session fixation

2018-09-1115:29:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

CPENameOperatorVersion
gluster_storagelt3.4

CPE	Name	Operator	Version
	gluster_storage	lt	3.4

References

www.securitytracker.com/id/1041597

access.redhat.com/errata/RHSA-2018:2616

bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127

github.com/Tendrl/api/pull/422