CVE-2016-8638 Session Fixation in ipsilon
CriticalCVSS 9.1
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ipsilon(PyPI) | >= 2.0.0, < 2.0.2 | 2.0.2 |
| pypi ipsilon(PyPI) | >= 1.2.0, < 1.2.1 | 1.2.1 |
| pypi ipsilon(PyPI) | = 1.2.0 | No fix listed |
| pypi ipsilon(PyPI) | >= 1.1.0, < 1.1.2 | 1.1.2 |
| pypi ipsilon(PyPI) | >= 1.0.0, < 1.0.3 | 1.0.3 |
| ipsilon project ipsilon | = 1.0.0 | No fix listed |
| ipsilon project ipsilon | = 1.0.1 | No fix listed |
| ipsilon project ipsilon | = 1.0.2 | No fix listed |
| ipsilon project ipsilon | = 1.1.0 | No fix listed |
| ipsilon project ipsilon | = 1.1.1 | No fix listed |
| ipsilon project ipsilon | = 1.2.0 | No fix listed |
| ipsilon project ipsilon | = 2.0.0 | No fix listed |
| ipsilon project ipsilon | = 2.0.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com vendor-advisory
- github.com product
- github.com
- ipsilon-project.org vendor-advisory
- ipsilon-project.org
- pagure.io patch vendor-advisory
- pypi.org product
- RHSA-2016:2809 vendor-advisory
- 94439 third-party-advisory vdb-entry