The session.lua library in CGILua 5.2 alpha 1 and 5.2... · CVE-2014-2875 · GitHub Advisory Database · GitHub

The session.lua library in CGILua 5.2 alpha 1 and 5.2...

Moderate severity Unreviewed Published May 17, 2022 to the GitHub Advisory Database • Updated Jan 28, 2023

Package

No package listed— Suggest a package

Affected versions

Unknown

Patched versions

Unknown

Description

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10300 and CVE-2014-10400 were SPLIT from this ID.

References

Published by the National Vulnerability Database

Feb 6, 2020

Published to the GitHub Advisory Database May 17, 2022

Last updated Jan 28, 2023