1. Home
  2. CVE Database
  3. CVE-2019-10045
MEDIUM · 6.5

CVE-2019-10045

The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reus...

Vulnerability Description

The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reused by an attacker to impersonate a user and perform actions on behalf of him/her (if the session is still active).

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
PydioPydio<= 8.2.2

Related Weaknesses (CWE)

CWE-384

References

FAQ

What is CVE-2019-10045?

CVE-2019-10045 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scripts to get access to its value. This identifier can be reus...

How severe is CVE-2019-10045?

CVE-2019-10045 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-10045?

Check the references section above for vendor advisories and patch information. Affected products include: Pydio Pydio.