CVE-2020-10714: netapp oncommand_insight Session Fixation

Vulnerability summary

CVE-2020-10714 is a high (CVSS 7.5) Session Fixation vulnerability in netapp oncommand_insight. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 73% of scored vulnerabilities.

Timeline

1. 23-09-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.