Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter.

published 2017-08-23 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-4486

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 15.7%; EPSS 15.7% chance of exploitation in 30 days, percentile 96%
public exploits: 1; Exploit-DB

Timeline

2017-08-21 First public exploit (EDB-42520)
2017-08-23 Published

Exploit prediction

15.67% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-42520 Apache2Triad 1.5.4 - Multiple Vulnerabilities webapps, 2017-08-21
hyp3rlinx.altervista.org http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt referenced PoC, tagged "exploit" by a source, unverified
packetstormsecurity.com http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-384 Session Fixation

References

exploit-db.com /exploits/42520/
exploit, third-party-advisory, vdb-entry
hyp3rlinx.altervista.org /advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt
exploit, third-party-advisory
packetstormsecurity.com /files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html
exploit, third-party-advisory, vdb-entry
securityfocus.com /bid/100447
vdb-entry, third-party-advisory

Sources

CVE List CVE-2017-12965
NVD CVE-2017-12965

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary