Description
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain.
References (16)
Core 16
Core References
Various Sources x_refsource_confirm
http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch
Various Sources x_refsource_confirm
http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch
Various Sources x_refsource_confirm
http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000177.html
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00761.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/37546
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/54472
Patch mailing-list
x_refsource_mlist
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00794.html
Various Sources x_refsource_confirm
http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch
Various Sources x_refsource_confirm
http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/37728
Various Sources x_refsource_confirm
http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00832.html
Various Sources x_refsource_confirm
http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/37162
Scores
EPSS
0.0274
EPSS Percentile
84.3%
Details
CWE
CWE-287
Status
published
Products (40)
bestpractical/rt
3.0.1
bestpractical/rt
3.0.2
bestpractical/rt
3.0.3
bestpractical/rt
3.0.4
bestpractical/rt
3.0.5
bestpractical/rt
3.0.6
bestpractical/rt
3.0.7
bestpractical/rt
3.0.7.1
bestpractical/rt
3.0.8
bestpractical/rt
3.0.9
... and 30 more
Published
Dec 02, 2009
Tracked Since
Feb 18, 2026