CVE-2020-5205

MEDIUM

Pow < 1.0.16 - Session Fixation via Persistent Session Store

Title source: llm
STIX 2.1

Description

In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0077
EPSS Percentile 50.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Details

CWE
CWE-384
Status published
Products (2)
Hex/pow 0 - 1.0.16Hex
powauth/pow < 1.0.16
Published Jan 09, 2020
Tracked Since Feb 18, 2026