CVE-2018-18380

State: Published
Severity: Not scored
Published: Oct 19, 2018
Updated: Aug 5, 2024
Reserved: Oct 16, 2018

Description

A Session Fixation issue was discovered in Bigtree before 4.2.24. admin.php accepts a user-provided PHP session ID instead of regenerating a new one after a user has logged in to the application. The Session Fixation could allow an attacker to hijack an admin session.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://gist.github.com/zionspike/680eb504db7c86296fad0eff30c6317f
https://github.com/bigtreecms/BigTree-CMS/tree/4.2.24
https://github.com/bigtreecms/BigTree-CMS/commit/c69402c4764ed9a76301c57277aefe70141b6418

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.