CVE-2018-12071: CodeIgniter Session Fixation Vulnerability
Summary
CVE-2018-12071: CodeIgniter Session Fixation Vulnerability. Affects codeigniter/framework versions < 3.1.10. Fixed in 3.1.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a popular PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process. The Session Library in CodeIgniter is responsible for managing user sessions. It allows developers to store and retrieve session data for each user. However, a vulnerability exists in versions of CodeIgniter prior to 3.1.9 that can be exploited to perform session fixation attacks. This vulnerability occurs due to mishandling of the session.use_strict_mode configuration in the Session Library.
Vulnerability Detail
The CodeIgniter Session Fixation vulnerability allows an attacker to hijack a user's session by fixing or setting the session ID. By exploiting this vulnerability, an attacker can impersonate the victim and perform actions on their behalf, potentially leading to unauthorized access, data leakage, or other malicious activities. The vulnerability is rated as critical with a CVSS score of 9.8.
How To Fix
Minimum fixed version
3.1.10
This is the first release that contains the fix.
composer require codeigniter/framework:3.1.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the latest version of CodeIgniter to mitigate the risk.
Conclusion
The CodeIgniter Session Fixation vulnerability is a critical security issue that can lead to unauthorized access and other malicious activities. It is crucial for developers to update their CodeIgniter installation to the latest version or apply the official patch to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for codeigniter/framework →
FAQ
CodeIgniter is a PHP framework used for developing web applications. It provides a set of libraries and tools that simplify the development process.
A session fixation attack is a type of attack where an attacker fixes or sets the session ID of a user. By doing so, the attacker can hijack the user's session and perform actions on their behalf.
The potential consequences of this vulnerability include unauthorized access to user accounts, data leakage, and other malicious activities performed on behalf of the victim.
The CVSS score of this vulnerability is 9.8, which indicates a critical severity level.
To fix this vulnerability, it is recommended to upgrade to CodeIgniter version 3.1.9 or later. This version includes a fix for the session fixation issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter/framework.
