Hubzero Cms
Monthly
Session fixation in HUBzero CMS through 2.2.32 lets unauthenticated remote attackers hijack authenticated accounts because the Session Manager accepts a session identifier from the ?PHPSESSID query string or a request/form variable whenever no session cookie is present; an attacker can obtain a valid id from the site, send the victim a crafted link containing it, and replay that id after the victim logs in. Exploitation is limited by user interaction - the victim must follow the attacker-supplied link and then authenticate under the fixated identifier (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N; vendor-published CVSS 4.0 base 8.5, VC:H/VI:H/VA:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vulnerable code path is publicly confirmed and the upstream fix commit is available.
Path traversal in HUBzero CMS through 2.2.32 lets authenticated project members write files to arbitrary paths outside the project repository, potentially achieving code execution when the written file lands in a web-servable, executable location. The flaw lives in the com_projects file-upload API (filefsv1_0.php upload/download tasks and filesv1_0.php chunkedUploadTask) and the projects/files plugin, where the 'subdir' and chunked-upload 'flowIdentifier' parameters flow unsanitized into move_uploaded_file/copy and base64-derived temp-directory paths. Exploitation is remote and needs no user interaction but requires a low-privileged project-member account (CVSS v4.0 PR:L); vendor fix commits are published, yet no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited.
Session fixation in HUBzero CMS through 2.2.32 lets unauthenticated remote attackers hijack authenticated accounts because the Session Manager accepts a session identifier from the ?PHPSESSID query string or a request/form variable whenever no session cookie is present; an attacker can obtain a valid id from the site, send the victim a crafted link containing it, and replay that id after the victim logs in. Exploitation is limited by user interaction - the victim must follow the attacker-supplied link and then authenticate under the fixated identifier (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N; vendor-published CVSS 4.0 base 8.5, VC:H/VI:H/VA:N). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, but the vulnerable code path is publicly confirmed and the upstream fix commit is available.
Path traversal in HUBzero CMS through 2.2.32 lets authenticated project members write files to arbitrary paths outside the project repository, potentially achieving code execution when the written file lands in a web-servable, executable location. The flaw lives in the com_projects file-upload API (filefsv1_0.php upload/download tasks and filesv1_0.php chunkedUploadTask) and the projects/files plugin, where the 'subdir' and chunked-upload 'flowIdentifier' parameters flow unsanitized into move_uploaded_file/copy and base64-derived temp-directory paths. Exploitation is remote and needs no user interaction but requires a low-privileged project-member account (CVSS v4.0 PR:L); vendor fix commits are published, yet no public exploit code has been identified at time of analysis and the issue is not known to be actively exploited.