Tribal Systems Zenario CMS vulnerable to Session Fixation

中 5.4CVE-2022-4231 · GHSA-6657-9743-4mc6 · 30/11/2022 公開 · 17/06/2026 更新

要点

CVE-2022-4231 は tribalsystems/zenario, zenario (tribalsystems) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.47%（全脆弱性の 40.9% より高い）。
修正版の情報はまだありません。参考情報のベンダー勧告を確認してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
tribalsystems/zenario Packagist	`≤ 9.3.57595`	修正版なし
zenario tribalsystems	`= 9.3.57595`	修正版なし

概要

Tribal Systems Zenario CMS 9.3.57595 is vulnerable to session fixation. In Zenario CMS, the user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after user logout and login again into the application when "Remember me" option active. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with. The attack may be initiated remotely and an exploit has been disclosed.

NVD の説明

A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the component Remember Me Handler. The manipulation leads to session fixiation. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214589 was assigned to this vulnerability.