CVE-2022-27305

    Dashboard / Vulnerabilities / CVE-2022-27305

    CVE-2022-27305

    Published: 25 May 2022Last Modified: 12 Aug 2026

    Summary:

    Details: Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27305.json, https://github.com/GibbonEdu/core/security/advisories/GHSA-4mq5-8jvh-qq3p, https://nvd.nist.gov/vuln/detail/CVE-2022-27305

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0617910814db148faf59e90a48a57f8bd1642eb0

    Affected versions

    v23.0.01
    v23.0.00
    v23.0.00-testbuild2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-27305 | CVE-DB