CVE-2009-3585
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Best Practical Solutions RT 3.0.0 到3.6.9版本以及3.8.x到3.8.5版本中的html/Elements/Setup会话Cookie存在会话劫持漏洞，使远程攻击者可以借助在同一域平衡一个第二网络服务器设置会话识别标来攻击网络会话。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2009-3585
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Best Practical Solutions RT html/Elements/Setup会话Cookie会话劫持漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Best Practical Solutions RT 3.0.0 到3.6.9版本以及3.8.x到3.8.5版本中的html/Elements/Setup会话Cookie存在会话劫持漏洞，使远程攻击者可以借助在同一域平衡一个第二网络服务器设置会话识别标来攻击网络会话。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2009-3585
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2009-3585
请登录查看更多情报信息。
Vendor Advisories for CVE-2009-3585 (4)
Mailing List Discussions for CVE-2009-3585 (2)
-
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000177.html mailing-list x_refsource_MLIST
-
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html mailing-list x_refsource_MLIST
Security Blog Posts for CVE-2009-3585 (1)
-
http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html x_refsource_CONFIRM
Other References for CVE-2009-3585 (8)
-
http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch x_refsource_CONFIRM
-
http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch x_refsource_CONFIRM
-
http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch x_refsource_CONFIRM
-
http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch x_refsource_CONFIRM
-
http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch x_refsource_CONFIRM
-
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00832.html vendor-advisory x_refsource_FEDORA
-
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00761.html vendor-advisory x_refsource_FEDORA
-
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00794.html vendor-advisory x_refsource_FEDORA
Same Patch Batch · n/a · 2009-12-02 · 35 CVEs total
| CVE-2009-4026 | Linux kernel 安全漏洞 | |
| CVE-2009-4161 | TYPO3 [AN] Search it!扩展跨站脚本攻击漏洞 | |
| CVE-2009-4162 | TYPO3 DB Integration扩展命令执行漏洞 | |
| CVE-2009-4163 | TYPO3 TW Productfinder扩展SQL注入漏洞 | |
| CVE-2009-4164 | TYPO3 simple Glossar扩展跨站脚本漏洞 | |
| CVE-2009-4165 | TYPO3 simple Glossar扩展SQL注入漏洞 | |
| CVE-2009-4166 | TYPO3 Trips扩展SQL注入漏洞 | |
| CVE-2009-4167 | TYPO3 RealUrl扩展未明安全漏洞 | |
| CVE-2009-2686 | HP NonStop 未名拒绝服务和安全权限提升漏洞 | |
| CVE-2009-4160 | TYPO3 Simple download-system扩展敏感信息泄露漏洞 | |
| CVE-2009-4027 | Linux kernel 竞争条件问题漏洞 | |
| CVE-2009-4151 | Best Practical Solutions RT 'html/Elements/SetupSessionCookie'会话劫持漏洞 | |
| CVE-2009-4152 | IBM WebSphere Portal 中Collaboration跨站脚本漏洞 | |
| CVE-2009-4153 | IBM WebSphere Portal 中XMLAccess未明漏洞 | |
| CVE-2009-3672 | Microsoft Internet Explorer HTML对象内存破坏漏洞 | |
| CVE-2009-4055 | Digium Asterisk Open Source 'rtp.c'RTP处理远程拒绝服务漏洞 | |
| CVE-2009-4150 | ibm db2 'dasauto'权限许可和访问控制漏洞 | |
| CVE-2009-4169 | Roy Tanck WP-Cumulus 'wp-cumulus.php'跨站脚本漏洞 | |
| CVE-2009-4147 | FreeBSD 权限许可和访问控制问题漏洞 | |
| CVE-2009-4171 | Yahoo! Messenger 'YahooBridgeLib.dll' ActiveX控件拒绝服务攻击 |
Showing top 20 of 35 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2009-3585
No comments yet