CVE-2013-10075
Description
A flaw was found in Apache::Session, a Perl module for managing user sessions. This vulnerability allows the session stores, specifically Apache::Session::Store::File and Apache::Session::Store::DB_File, to recreate sessions that were previously deleted. This can lead to the revival of old sessions, potentially with data that was intended to be removed, primarily impacting data integrity.
Statement
Low impact. This flaw in the Apache::Session Perl module allows for the re-creation of previously deleted sessions. While this primarily affects data integrity by reviving old session records, it does not directly lead to data leakage or modification. Exploitation for authentication bypass is application-dependent and not a direct consequence of the flaw itself.
Mitigation
The vulnerable session store backends (Apache::Session::Store::File and Apache::Session::Store::DB_File) can be replaced with a DBI-based backend such as Apache::Session::Store::DBI, Apache::Session::Store::MySQL, or Apache::Session::Store::Postgres, which are not affected by this flaw. Applications using Apache::Session::Flex can change the Store parameter without other code changes. As an additional defense, applications should validate session contents (e.g. authentication tokens or user attributes) rather than treating session existence alone as proof of authentication.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 9.1 | 9.1 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | Low | High | High |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat CVSS v3 Score Explanation
The direct consequence of a successful exploit is a phantom empty session — no data leaked, no data modified, just a session record that shouldn't exist, which only affects the Integrity. The auth bypass, which is necessary for C:H and I:H, is application-dependent and indirect.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
