CVE-2020-5205CWE-384

Session fixation attack in Pow (Hex package)

Medium · published January 9, 2020

CVSS v3.1
6.5
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00770 · 55.2th percentile
Weakness
CWE-384 · Session Fixation
Published
2020-01-09T02:05Z
EPSS history
Timeline
  • 09 JAN 02:05Z
    Session fixation attack in Pow (Hex package)
    cvelistv5