CVE-2020-5205

—

CVSS 3.1

5.4 medium

EPSS

<1%p53

Published

Jan 9, 2020 (Jan 9, 2020)

Modified

Jun 17, 2026

Description

In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.

Vendors: powauth
Products: pow
Weakness: CWE-384
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news0 stories

No ingested article mentions this CVE yet.