CVE-2009-4151

Best Practical Solutions RT <3.6.9, <3.8.5 - Session Fixation

Title source: llm

Description

Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages "HTTP access to the RT server," a related issue to CVE-2009-3585.

References (16)

Core 16

Core References

Patch mailing-list x_refsource_mlist

http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000177.html

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00761.html

Patch x_refsource_confirm

http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37546

Patch x_refsource_confirm

http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/54472

Patch mailing-list x_refsource_mlist

http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00794.html

Patch x_refsource_confirm

http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch

Patch x_refsource_confirm

http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/37728

Patch x_refsource_confirm

http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00832.html

Patch x_refsource_confirm

http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html

Patch x_refsource_confirm

http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch

Patch vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/37162

Scores

EPSS 0.0184

EPSS Percentile 76.3%

Details

CWE

CWE-287

Status published

Products (40)

bestpractical/rt 3.0.1

bestpractical/rt 3.0.2

bestpractical/rt 3.0.3

bestpractical/rt 3.0.4

bestpractical/rt 3.0.5

bestpractical/rt 3.0.6

bestpractical/rt 3.0.7

bestpractical/rt 3.0.7.1

bestpractical/rt 3.0.8

bestpractical/rt 3.0.9

... and 30 more

Published Dec 02, 2009

Tracked Since Feb 18, 2026