CVE-2020-12258: Critical severity rconfig vulnerability

Published May 18, 2020

Updated

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259.

Affected Software

1 affected component

rConfig rConfig=3.9.4

Event History

May 18, 2020

CVE Published

via MITRE·01:01 PM

Data Sourced

via MITRE·01:01 PM

Description

Frequently Asked Questions

What is CVE-2020-12258?

CVE-2020-12258 is a vulnerability in rConfig 3.9.4 that allows session fixation due to mishandled session expiry and randomization.

How severe is CVE-2020-12258?

CVE-2020-12258 has a severity rating of 9.1 (critical).

What software versions are affected by CVE-2020-12258?

rConfig version 3.9.4 is affected by CVE-2020-12258.

How can an attacker exploit CVE-2020-12258?

An attacker can exploit CVE-2020-12258 by reusing a session via PHPSESSID and leveraging vulnerabilities like CVE-2020-12256 or CVE-2020-12259.

Are there any references available for CVE-2020-12258?

Yes, you can find more information about CVE-2020-12258 at the following reference: [GitHub Gist](https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8)