CVE-2016-8638

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2016-2809.html
http://www.securityfocus.com/bid/94439Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638Issue Tracking, Third Party Advisory
https://ipsilon-project.org/advisory/CVE-2016-8638.txtVendor Advisory
https://ipsilon-project.org/release/2.1.0.html
https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461cPatch, Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2016-2809.html
http://www.securityfocus.com/bid/94439Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638Issue Tracking, Third Party Advisory
https://ipsilon-project.org/advisory/CVE-2016-8638.txtVendor Advisory
https://ipsilon-project.org/release/2.1.0.html
https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461cPatch, Vendor Advisory

Timeline

Published: Jul 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-86395.4It was found that foreman before 1.13.0 is vulnerable to a stored XSS via an organization or location name. This could allow an attacker wit CVE-2016-86409.1A SQL injection vulnerability in pycsw all versions before 2.0.2, 1.10.5 and 1.8.6 that leads to read and extract of any data from any table CVE-2016-86417.8A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely ch CVE-2016-86425.3In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.CVE-2016-86434.3In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.CVE-2016-86445.3In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.CVE-2016-86455.5The TCP stack in the Linux kernel before 4.8.10 mishandles skb truncation, which allows local users to cause a denial of service (system cra CVE-2016-86465.5The hash_accept function in crypto/algif_hash.c in the Linux kernel before 4.3.6 allows local users to cause a denial of service (OOPS) by a CVE-2016-86474.9An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in CVE-2016-86487.2It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via CVE-2016-86499.1lxc-attach in LXC before 1.0.9 and 2.x before 2.0.6 allows an attacker inside of an unprivileged container to use an inherited file descript CVE-2016-86505.5The mpi_powm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which