[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Re: [MajorSecurity Advisory #54]xt:Commerce - Cross Site Scripting and Session Fixation Issues
- From: admin@xxxxxxxxxxxxxxxx
- Date: 22 Sep 2008 18:09:05 -0000
It's not the "PHPSESSID" parameter - instead it's the "XTCsid" parameter which
is vulnerable to a session fixation attack.
Workaround:
================
Update to xt:Commerce 3.0.4 SP 2.1