Description

IIS 4.0 and 5.0 .ASP pages send the same Session ID cookie for secure and insecure web sessions, which could allow remote attackers to hijack the secure web session of the user if that user moves to an insecure session, aka the "Session ID Cookie Marking" vulnerability.

Remediation

References

CVE-2000-0970

Related Vulnerabilities

MySQL CVE-2022-21357 Vulnerability (CVE-2022-21357)

WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-5204)

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-18470)

WordPress Plugin Email Subscribers by Icegram Express-Email Marketing, Newsletters, Automation for WordPress & WooCommerce SQL Injection (5.7.14)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2008-6832)

Severity

High

Classification

CVE-2000-0970

Tags

Missing Update Known Vulnerabilities