CVE-2022-44007

An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt	Exploit Third Party Advisory
https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037	Third Party Advisory
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt	Exploit Third Party Advisory
https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:backclick:backclick:5.9.63:*:*:*:professional:*:*:*

History

21 Nov 2024, 07:27

Type	Values Removed	Values Added
References	~~() https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt - Exploit, Third Party Advisory~~	() https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt - Exploit, Third Party Advisory
References	~~() https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - Third Party Advisory~~	() https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037 - Third Party Advisory

Information

Published : 2022-11-16 22:15

Updated : 2024-11-21 07:27

NVD link : CVE-2022-44007

Mitre link : CVE-2022-44007

CVE.ORG link : CVE-2022-44007

JSON object : View

Products Affected

backclick

backclick

CWE

CWE-384

Session Fixation

{"id": "CVE-2022-44007", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-11-16T22:15:11.177", "references": [{"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-036.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.syss.de/pentest-blog/vielfaeltige-schwachstellen-in-backclick-professional-syss-2022-026-bis-037", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en BACKCLICK Professional 5.9.63. Debido a una implementaci\u00f3n insegura del seguimiento de sesiones, es posible que un atacante enga\u00f1e a los usuarios para que abran una sesi\u00f3n de usuario autenticado para un identificador de sesi\u00f3n conocido por el atacante, tambi\u00e9n conocido como Session Fixation."}], "lastModified": "2024-11-21T07:27:30.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:backclick:backclick:5.9.63:*:*:*:professional:*:*:*", "vulnerable": true, "matchCriteriaId": "0E17FA20-4500-435D-8F99-58317752E37D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}