PHP Session Fixation
Priority MEDIUM 48CWE-384Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-384.
Summary
Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeover on a product. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00426 37th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ABB | ASPECT-Enterprise | up to 3.08.02 | — | No fix listed | CNA |
| ABB | NEXUS Series | up to 3.08.02 | — | No fix listed | CNA |
| ABB | MATRIX Series | initial – 3.08.02 | — | No fix listed | CNA |
- ASPECT-Enterprise VendorABB Affected up to 3.08.02 Fixed in — No fix listed CNA
- NEXUS Series VendorABB Affected up to 3.08.02 Fixed in — No fix listed CNA
- MATRIX Series VendorABB Affected initial – 3.08.02 Fixed in — No fix listed CNA
CPE configurations NVD · 38
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:abb:aspect-ent-2_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:aspect-ent-256_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-256:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:aspect-ent-96_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-96:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-2128_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-2128:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-2128-a_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-2128-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
- cpe:2.3:o:abb:aspect-ent-2_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:aspect-ent-256_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-256:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:aspect-ent-96_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-96:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-2128_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-2128:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-2128-a_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-2128-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
Show 28 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:abb:nexus-2128-f_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-2128-f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-2128-g_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-2128-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-264_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-264-a_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-264-a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-264-g_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-264-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-3-2128_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-3-2128:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:aspect-ent-12_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:aspect-ent-12:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-264-f_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-264-f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:nexus-3-264_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:nexus-3-264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-11_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-11:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-216_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-216:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-232_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-232:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-264_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
| cpe:2.3:o:abb:matrix-296_firmware:*:*:*:*:*:*:*:* | before 3.08.03 | Vulnerable | ABB |
| cpe:2.3:h:abb:matrix-296:-:*:*:*:*:*:*:* | not specified by NVD | Running on | ABB |
- cpe:2.3:o:abb:nexus-2128-f_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-2128-f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-2128-g_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-2128-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-264_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-264-a_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-264-a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-264-g_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-264-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-3-2128_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-3-2128:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:aspect-ent-12_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:aspect-ent-12:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-264-f_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-264-f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:nexus-3-264_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:nexus-3-264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-11_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-11:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-216_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-216:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-232_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-232:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-264_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
- cpe:2.3:o:abb:matrix-296_firmware:*:*:*:*:*:*:*:* Versions before 3.08.03 Vulnerable ·ABB
- cpe:2.3:h:abb:matrix-296:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ABB
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-11317
- 2026-10-03 Alias added: GHSA-2x57-wp24-3gfm
References
More ABB Aspect-ent-12 Firmware vulnerabilities
- TI-2024-05845 Remote code execution in ABB ASPECT-Enterprise CVSS 4.0CRITICAL 9.4
- TI-2024-34459 Service control in ABB ASPECT-Enterprise CVSS 4.0HIGH 8.8
- TI-2024-05758 unauthorized file access CVSS 4.0CRITICAL 9.4
- TI-2024-32539 Remote code execution, RCE in ABB ASPECT-Enterprise CVSS 4.0CRITICAL 9.3
- TI-2024-34465 Data Validation / Sanitization CVSS 4.0CRITICAL 9.3
- TI-2024-32545 Weak Password Rules/Strength CVSS 4.0CRITICAL 9.3
Sources
- CVE-2024-11317 · CVE Program
- CVE-2024-11317 · NVD
- FIRST EPSS
- GHSA-2x57-wp24-3gfm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences