| Package | Affected versions | Patched versions |
|---|---|---|
| zoneminder | ≤ 1.32.3 |
Session fixation exists in ZoneMinder through 1.32.3, as an attacker can fixate his own session cookies to the next logged-in user, thereby hijacking the victim's account. This occurs because a set of multiple cookies (between 3 and 5) is being generated when a user successfully logs in, and these sets overlap for successive logins.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free