CVE-2009-4151

Severity: medium (CVSS 5.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-12-02 · updated 2026-06-16
Weakness: CWE-287

Description

Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages "HTTP access to the RT server," a related issue to CVE-2009-3585.

Affected products

bestpractical rt: 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6 (+34)

References

http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch
http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch
http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch
http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch
http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch
http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch
http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html
http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000177.html
http://secunia.com/advisories/37546
http://secunia.com/advisories/37728
http://www.securityfocus.com/bid/37162

Get alerted when CVE-2009-4151 or the next vulnerability affects your stack