CVE-2016-0721: High severity clusterlabs vulnerability
Session fixation vulnerability in pcsd in pcs before 0.9.157.
Other sources
The session cookie is not invalidated on the server side when logging out of the web UI. It is invalidated in the browser's cookie cache but it still works on requests sent by hand.
The cookie is also not invalidated when that same user log in again, meaning all cookies are stored in a pool of valid sessions that are only invalidated when the cookies expires (1 day).
This can allow attackers to perform session fixation attacks.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-0721?
CVE-2016-0721 is considered a medium severity vulnerability due to its potential exploitation to maintain user session control.
How do I fix CVE-2016-0721?
To fix CVE-2016-0721, upgrade pcs to version 0.9.157 or later, which addresses the session fixation issue.
What software is affected by CVE-2016-0721?
CVE-2016-0721 affects pcs versions prior to 0.9.157, as well as specific Fedora and Red Hat Enterprise Linux versions.
What type of vulnerability is CVE-2016-0721?
CVE-2016-0721 is a session fixation vulnerability that allows unauthorized users to maintain an active session after logout.
What are the consequences of exploiting CVE-2016-0721?
Exploiting CVE-2016-0721 can allow an attacker to hijack a user's session and perform unauthorized actions as that user.