CVE-2014-10399

In CGILua, CVE-2014-10399 stems from the session.lua library using non-unique/weak session IDs across sessions. CGILua 5.1.x creates identical IDs per session, enabling remote hijacking; CGILua 5.0.x uses sequential IDs; 5.2 alpha releases also generate weak IDs. The vulnerability allows session ...