Skip to main content

Session Fixation

CVE-2024-48929

Medium
4.2/10

Summary

Umbraco is a free and open-source .NET content management system. In versions on the 10.x prior to 10.8.7 and 13.x prior to 13.5.2, during an explicit sign-out, the server session is not fully terminated. This could potentially allow unauthorized users to continue accessing a session after a user has explicitly signed out, posing a security risk.

  • HIGH
  • NETWORK
  • LOW
  • UNCHANGED
  • REQUIRED
  • NONE
  • LOW
  • NONE

CWE-384 - Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References

Advisory Timeline

  • Published