Title: Drupal Session Fixation Vulnerability
Severity: MODERATE
Description:
Drupal is a PHP-based content manager.
Drupal is prone to a session-fixation vulnerability caused by a design error when handling sessions. Specifically, an attacker can predefine a victim user's session ID. When the unsuspecting victim logs in, the attacker can hijack the session and gain unauthorized access to the affected application.
This issue affects Drupal 5.x before 5.9 and Drupal 6.x before 6.3.
NOTE: This issue was originally covered in BID 30168 (Drupal Multiple Remote Vulnerabilities) and was supposed to be addressed by Drupal 5.8. However, the vendor has confirmed that this issue was not fixed and still exists in Drupal 5.8. Therefore, this issue has been assigned its own BID.
Affected Products:
- Drupal Drupal 5.0
- Drupal Drupal 5.1
- Drupal Drupal 5.2
- Drupal Drupal 5.3
- Drupal Drupal 5.4
- Drupal Drupal 5.5
- Drupal Drupal 5.6
- Drupal Drupal 5.8
- Drupal Drupal 6.0
- Drupal Drupal 6.1
- Drupal Drupal 6.2
References:
- Drupal: Drupal Homepage
- Drupal: SA-2008-044 - Drupal core - Multiple vulnerabilities
- Drupal: SA-2008-046 - Drupal core - Session fixation
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
