Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie.
Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
High
Admin privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 3
https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L…
security-advisories@github.com
https://github.com/Admidio/admidio/blob/v5.0.9/src/Session/Entity/Session.php#L…
security-advisories@github.com
https://github.com/Admidio/admidio/security/advisories/GHSA-mch8-wf3h-6x88
security-advisories@github.com