CVE-2015-5384

Vulnerability

AxiomSL's Axiom Google Web Toolkit (GWT) module versions 9.5.3 and earlier are vulnerable to a session fixation attack. The application does not properly invalidate existing session identifiers upon user authentication, allowing an attacker to force a victim into using a known session ID [1].

Exploitation

An attacker must first obtain a valid session identifier from the application (e.g., by visiting the login page) and then trick the victim into authenticating with that same session ID, typically via a crafted link or cross-site scripting. No special network position is required beyond the ability to deliver the malicious link to the victim [1].

Impact

Successful exploitation allows the attacker to hijack the victim's authenticated session, gaining unauthorized access to the victim's account and any data or functionality available to that user. The attacker can perform actions as the victim without needing credentials [1].

Mitigation

Not disclosed in the available references. Users should contact AxiomSL for patched versions or apply any vendor-supplied updates. As of the publication date, no fixed version is mentioned in the advisory [1].