Description
OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.
Remediation
References
Related Vulnerabilities
Apache Tomcat URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-41080)
MediaWiki Improper Input Validation Vulnerability (CVE-2017-8811)
Apache HTTP Server Other Vulnerability (CVE-2001-1072)
Joomla! Core 3.x.x Cross-Site Scripting (3.1.2 - 3.8.7)
WordPress Plugin AddToAny Share Buttons Cross-Site Scripting (1.7.45)