Description

mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.

Remediation

References

CVE-2013-2249

Related Vulnerabilities

phpList Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-23207)

Lodash Improper Neutralization of Special Elements used in a Command ('Command Injection') Vulnerability (CVE-2021-23337)

WordPress Plugin Contact Form by ContactMe.com Cross-Site Scripting (2.3)

Joomla! Core 4.0.0 Security Bypass (4.0.0)

WordPress Plugin Activity Log Cross-Site Scripting (2.3.1)

Severity

High

Classification

CVE-2013-2249

Tags

Missing Update Known Vulnerabilities