HUBzero CMS versions up to and including 2.2.32 accept session identifiers from query strings and request variables rather than only from cookies. This behavior enables an unauthenticated attacker to obtain a valid session identifier and send a crafted link containing this identifier to a victim. When the victim authenticates using this session, the attacker can replay the session identifier to hijack the victim's authenticated session and gain unauthorized access to their account.

Successful exploitation allows an attacker to hijack authenticated user sessions, leading to unauthorized access to victim accounts. This compromises user confidentiality and potentially integrity within the HUBzero CMS environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid sharing session identifiers in URLs or request variables and consider implementing additional session management controls to prevent session fixation.