Re: CVE request: Apache Axis2 Session Fixation

[security curmudgeon <jericho () attrition org>]

: there has recently been a Session Fixation vulnerability reported in Apache 
: Axis2, see:
: 
: References:
: https://issues.apache.org/jira/browse/AXIS2-4739
: http://www.securityfocus.com/archive/1/511955/30/30/threaded
: 
: There is already CVE-2010-2103 assigned for the Cross-Site Scripting 
: mentioned in the advisory above. However, there does not seem to be a 
: CVE for the Session Fixation flaw, so could you possibly assign one for 
: it too?

Can we also get a CVE assigned for the other 186 issues I found in 
issues.apache.org dating back to 2002-03-04? CVE covers 73 of the 259 
issues, some much more serious than session fixation in Axis.

On a more serious note, does it have to be posted to Bugtraq or F-D to get 
attention here? If you search osvdb.org by reference for 
"issues.apache.org", you will see a substantional amount of 
vulnerabilities that are higher risk (e.g., auth bypass, XSS, arbitrary 
file disclosure, cleartext password disclosure, etc). Consider there were 
almost two dozen more vulnerabilities that didn't get added to OSVDB 
because the bug reports were too vague, inconclusive and/or the Apache 
staff never responded in any fashion to clarify the severity or verify the 
report. If we had more time to actually dig into the report / code, they 
likely would have been added. 

I am not entirely sure why this one is important enough to warrant an 
individual request to CVE for assignment, when much more serious issues 
exist, some of which are still oustanding last I checked.

If CVE does assign an entry to this, please assign one to OSVDB 58803 for 
an Apache Wicket Session Fixation issue too. Thanks!

- security curmudgeon