high8.8
CVE-2022-27305
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
Impact
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gibbonedu | Gibbon | before 23.0.02 |