Back to Database
Status published
Medium
CVE-2009-3585
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT...
Vulnerability Description
Session fixation vulnerability in html/Elements/SetupSessionCookie in Best Practical Solutions RT 3.0.0 through 3.6.9 and 3.8.x through 3.8.5 allows remote attackers to hijack web sessions by setting the session identifier via a manipulation that leverages a second web server within the same domain.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-3585
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000177.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00761.html
- http://bestpractical.typepad.com/files/rt-3.6.2-3.6.3-session_fixation.v3.patch
- http://secunia.com/advisories/37546
- http://bestpractical.typepad.com/files/rt-3.6.4-3.6.9-session_fixation.v2.patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54472
- http://lists.bestpractical.com/pipermail/rt-announce/2009-November/000176.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00794.html
- http://bestpractical.typepad.com/files/rt-3.0.0-session_fixation.v3.patch
- http://bestpractical.typepad.com/files/rt-3.0.1-3.0.6-session_fixation.v3.patch
- http://secunia.com/advisories/37728
- http://bestpractical.typepad.com/files/rt-3.0.7-3.6.1-session_fixation.v3.patch
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00832.html
- http://blog.bestpractical.com/2009/11/session-fixation-vulnerability.html
- http://bestpractical.typepad.com/files/rt-3.8-session_fixation.patch
- http://www.securityfocus.com/bid/37162
More from bestpractical
View All →CVE-2025-61873
Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2...
Low
2.6
CVE-2025-31501
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS...
High
7.2
CVE-2025-31500
Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS...
High
7.2
CVE-2025-30087
Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0...
High
7.2
CVE-2022-25803
Best Practical Request Tracker (RT) before 5.0.3 has an Open...
Medium
6.1
Affected Vendor
bestpractical
View all reports →Affected Software
rt
Vulnerable Versions:
3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.7.1, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5
Timeline
Official Publish:
December 2nd, 2009
Last Modified:
August 7th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.