Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability

Bugtraq ID:	41076
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 23 2010 12:00AM
Updated:	Jun 23 2010 12:00AM
Credit:	Tiago Ferreira Barbosa
Vulnerable:	Apache Axis2 1.4.1 Apache Axis2 1.5
Not Vulnerable:

Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability

Apache Axis2 is prone to a session-fixation vulnerability.

Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.

Apache Axis2 1.5 is vulnerable; other versions may also be affected.

Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

The following example URI is available:

• /data/vulnerabilities/exploits/41076.html

Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Apache Axis2 '/axis2/axis2-admin' Session Fixation Vulnerability

References:

• Apache AXIS2 Homepage (Apache)