Threats tagged 'ghsa-qqf3-jqrg-fm5r'

Apache Wicket versions 8.18.0 through 8.19.0, 9.23.0 through 9.24.0, and 10.9.0 through 10.11.0 are affected by a session fixation vulnerability. The issue arises because the session ID is renewed only on the first sign-in, not on subsequent authentications within the same session. This allows an attacker who can fix a session ID in a victim's browser and has a signed-in session to bypass session ID renewal on re-authentication, potentially enabling session fixation attacks. Upgrading to versions 8.20.0, 9.25.0, or 10.12.0 mitigates this vulnerability.