CVE-2021-33394: Medium severity cubecart vulnerability
Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33394?
The severity of CVE-2021-33394 is medium with a CVSS score of 5.4.
How does Cubecart 6.4.2 allow session fixation?
Cubecart 6.4.2 allows session fixation by not generating a new session cookie after the user is logged in.
What is the impact of session fixation in Cubecart 6.4.2?
The impact of session fixation in Cubecart 6.4.2 is that a malicious user can create a new session cookie value and inject it to a victim, giving the attacker unauthorized access.
Is there a fix available for CVE-2021-33394?
Yes, there is a fix available for CVE-2021-33394. Users should update to a version of Cubecart that includes the fix.
Where can I find more information about CVE-2021-33394?
More information about CVE-2021-33394 can be found at the following references: [GitHub Commit](https://github.com/cubecart/v6/commit/aac7b3a13a43e302d91f94a120417b2fda737d0f) and [Session Fixation in Cubecart 6.4.2](https://github.com/xoffense/POC/blob/main/Session%20Fixation%20in%20Cubecart%206.4.2.md).