CVE-2026-33384
Gravedad CVSS v4.0:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
29/05/2026
Última modificación:
29/05/2026
Descripción
*** Pendiente de traducción *** QuickCMS allows a user&#39;s session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID<br />
for a victim and later hijack the authenticated session.<br />
<br />
This issue was fixed in a patch to version 6.8 published on 15.05.2026, deployments without this patch are still vulnerable.
Impacto
Puntuación base 4.0
4.80
Gravedad 4.0
MEDIA