CVE-2018-18380

Published: 2018-10-19T20:29Z

Last Modified: 2024-11-21T03:55Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt