Session Fixation

2022-08-2604:46:48

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

snipe-it

session fixation

passwordsave

profilecontroller.php

vulnerability

EPSS

0.001

Percentile

40.5%

JSON

snipe/snipe-it is vulnerable to session fixation. The vulnerability exists in passwordsave function in ProfileController.php due to not logging the user out of other devices when changing the password which allows the attacker to submit an old password session link to access the system.