Skip to main content

Session Fixation

CVE-2025-64100

Medium
6.1/10

Summary

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. In versions 2.10.0 through 2.10.8 and 2.11.0 through 2.11.3, session ids could be fixed by an attacker if the site is configured with server-side session storage (CKAN uses cookie-based session storage by default). The attacker would need to either set a cookie on the victim's browser or steal the victim's currently valid session. Session identifiers are now regenerated after each login.

  • HIGH
  • NETWORK
  • NONE
  • CHANGED
  • REQUIRED
  • NONE
  • HIGH
  • NONE

CWE-384 - Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References

Advisory Timeline

  • Published