silverstripe/framework's User-Agent header not correctly invalidating user session
Date: 2024-05
Affected: composer/silverstripe/framework, composer/silverstripe/framework
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CWE: CWE-384
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

A security protection device in Session designed to protect session hijacking was not correctly functioning. This function intended to protect user sessions by detecting changes in the User-Agent header, but modifications to this header were not correctly invalidating the user session.


Mitigations:

Architectural layers (MAESTRO):