Claroline E-Learning Session Hijacking Vulnerability
BID:16341
Info
Claroline E-Learning Session Hijacking Vulnerability
| Bugtraq ID: | 16341 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 20 2006 12:00AM |
| Updated: | Feb 07 2006 08:55PM |
| Credit: | [email protected] is credited with the discovery of this vulnerability. |
| Vulnerable: |
Claroline Claroline 1.7.2 |
| Not Vulnerable: | |
Discussion
Claroline E-Learning Session Hijacking Vulnerability
Claroline e-Learning is prone to a session-hijacking vulnerability. This issue is due to the way the application creates cookie session data.
An attacker can exploit this issue to authenticate to the application as any valid logged-in user. This may facilitate a compromise of the application if an administrative account is used.
Claroline e-Learning is prone to a session-hijacking vulnerability. This issue is due to the way the application creates cookie session data.
An attacker can exploit this issue to authenticate to the application as any valid logged-in user. This may facilitate a compromise of the application if an administrative account is used.
Exploit / POC
Claroline E-Learning Session Hijacking Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Claroline E-Learning Session Hijacking Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Claroline E-Learning Session Hijacking Vulnerability
References:
References: