8.8

CVE-2022-31888

Exploit
Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Enhancesoft ≫ Osticket Version <= 1.16.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.21% 0.646
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/
Exploit
https://github.com/osTicket/osTicket/commit/85a76f403a3a116176d0798f39a4c430181d8364
Patch
https://github.com/osTicket/osTicket/releases/tag/v1.16.3
Release Notes