An issue was discovered in Joomla! Core before 3.8.8. A long running background process, such as remote checks for core or extension updates, could create a race condition where a session that was expected to be destroyed would be recreated.
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
| Link | Tags |
|---|---|
| https://developer.joomla.org/security-centre/735-20180507-core-session-deletion-race-condition.html | vendor advisory |
| http://www.securityfocus.com/bid/104274 | vdb entry third party advisory |
| http://www.securitytracker.com/id/1040966 | vdb entry third party advisory |