CVE-2010-1434

Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://developer.joomla.org/security-centre/309-20100423-core-sessation-fixation.html	Vendor Advisory
https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-session-fixation-1-5-0-1-5-15/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-06-21 23:15

Updated : 2021-06-25 15:36

NVD link : CVE-2010-1434

Mitre link : CVE-2010-1434

CVE.ORG link : CVE-2010-1434

JSON object : View

Products Affected

joomla

joomla\!

CWE

CWE-384

Session Fixation

{"id": "CVE-2010-1434", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2021-06-21T23:15:09.703", "references": [{"url": "https://developer.joomla.org/security-centre/309-20100423-core-sessation-fixation.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://www.acunetix.com/vulnerabilities/web/joomla-core-1-5-x-session-fixation-1-5-0-1-5-15/", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "Joomla! Core is prone to a session fixation vulnerability. An attacker may leverage this issue to hijack an arbitrary session and gain access to sensitive information, which may help in launching further attacks. Joomla! Core versions 1.5.x ranging from 1.5.0 and up to and including 1.5.15 are vulnerable."}, {"lang": "es", "value": "Joomla! Core es propenso a una vulnerabilidad de fijaci\u00f3n de sesi\u00f3n. Un atacante puede aprovechar este problema para secuestrar una sesi\u00f3n arbitraria y conseguir acceso a informaci\u00f3n confidencial, que puede ayudar a lanzar futuros ataques. Joomla! Core versiones 1.5.x que van desde la 1.5.0 hasta la 1.5.15 e incluy\u00e9ndola son vulnerables"}], "lastModified": "2021-06-25T15:36:14.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:joomla:joomla\\!:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6FB5F3E-58F9-4702-927A-0716AB6EC673", "versionEndIncluding": "1.5.15", "versionStartIncluding": "1.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}