CVE-2022-44007

Published Nov 16, 2022

Last updated 2 years ago

Overview

Description: An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-384

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:backclick:backclick:5.9.63:*:*:*:professional:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0E17FA20-4500-435D-8F99-58317752E37D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References