dl Download Ticket Service Session Fixation and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	61034
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 05 2013 12:00AM
Updated:	Jul 05 2013 12:00AM
Credit:	Dirk Reimers and Vendor
Vulnerable:	dl Download Ticket Service dl Download Ticket Service 0.9.1 dl Download Ticket Service dl Download Ticket Service 0.9 dl Download Ticket Service dl Download Ticket Service 0.10.1
Not Vulnerable:	dl Download Ticket Service dl Download Ticket Service 0.11

dl Download Ticket Service Session Fixation and Cross Site Request Forgery Vulnerabilities

dl Download Ticket Service is prone to session-fixation and cross-site request-forgery vulnerabilities.

An attacker can exploit these issues to hijack an arbitrary session and gain unauthorized access to the affected application or perform certain administrative actions on the user's behalf.

Versions prior to dl Download Ticket Service 0.11 are vulnerable.

dl Download Ticket Service Session Fixation and Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

dl Download Ticket Service Session Fixation and Cross Site Request Forgery Vulnerabilities

References:

• dl 0.11 changelog (dl Download Ticket Service)
  
• dl Download Ticket Service Homepage (dl Download Ticket Service)