CVE-2019-10045: Medium severity pydio cells vulnerability
The "action" getsessid in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her (if the session is still active).
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10045?
CVE-2019-10045 refers to a vulnerability in Pydio web application that allows the session cookie value to be disclosed in the response body.
How does CVE-2019-10045 affect Pydio?
CVE-2019-10045 affects Pydio versions up to and including 8.2.2.
What is the severity of CVE-2019-10045?
CVE-2019-10045 has a severity rating of medium with a severity value of 6.5.
How can an attacker exploit CVE-2019-10045?
An attacker can exploit CVE-2019-10045 by obtaining the session cookie value and impersonating a user to perform unauthorized actions.
Is there a fix for CVE-2019-10045?
Yes, upgrading Pydio to a version beyond 8.2.2 will fix the vulnerability.