Threats tagged 'ghsa-79wv-8rh2-9vp2'

AdminNeo versions 4.6.0 through 5.5.0 are vulnerable to cookie attribute injection via the unsanitized X-Forwarded-Prefix HTTP header. This allows an attacker who can control or influence this header to inject arbitrary cookie attributes into all Set-Cookie response headers, including session and encryption key cookies. The vulnerability enables session hijacking, credential theft, and session fixation by manipulating cookie scope and attributes. The issue arises from concatenating the X-Forwarded-Prefix header directly into the REQUEST_URI without sanitization and manually constructing Set-Cookie headers without escaping. A fix is available in AdminNeo version 5.5.1.