CVE-2022-27305
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
Gibbon v23 does not generate a new session ID after user authentication, making it vulnerable to session fixation attacks. An attacker can force a victim to use a known session ID and then hijack the session after login.
Risk Assessment
The organization is at risk of session hijacking, potentially leading to unauthorized access to sensitive data and system functions.
Recommendation
Update Gibbon to the latest version that regenerates session IDs upon login. If an update is not possible, implement server-side session regeneration.
Other vulnerabilities in Gibbon
See all- CVE-2023-34598Critical
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.
- CVE-2026-8209Medium
Gibbon before version 30.0.01 has a path traversal vulnerability leading to DoS by attempting extraction of PHP files. Failed .zip extraction results in file deletion and DoS. Teacher or higher privileges required.
- CVE-2026-8208High
Gibbon versions before v30.0.01 are affected by a local file inclusion vulnerability resulting in RCE by changing the report archive directory and forcing interpretation of a user-provided .zip as PHP. Successful exploitation requires Teacher or higher privileges.
- CVE-2026-8207High
Gibbon before version v30.0.01 has an SQL injection vulnerability in the Tracking/graphing feature. An authenticated user with Teacher or higher privileges can inject SQL, leading to unauthorized read/write in the database.
- CVE-2023-34599Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.
Original NVD description (English source)
Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.