ClipperCMS 1.3.3 allows Session Fixation.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Link | Tags |
---|---|
https://github.com/ClipperCMS/ClipperCMS/issues/486 | third party advisory |