CVE-2020-12258

—

CVSS 3.1

9.1 critical

EPSS

2%p76

Published

May 18, 2020 (May 18, 2020)

Modified

Jun 17, 2026

Description

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259.

Vendors: rconfig
Products: rconfig
Weakness: CWE-384
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news0 stories

No ingested article mentions this CVE yet.