CVE-2022-0991

HIGH8.2EPSS 0.24%

Insufficient Session Expiration in Admidio

發布日:2022/3/20修改日:2023/11/8

描述

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.

受影響套件(1)

Packagist/admidio/admidiofrom 0, < 4.1.9

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.2	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-0991
PATCHhttps://github.com/Admidio/admidio
WEBhttps://github.com/admidio/admidio/commit/e84e472ebe517e2ff5795c46dc10b5f49dc4d46a
WEBhttps://github.com/Admidio/admidio/issues/1238
WEBhttps://github.com/Admidio/admidio/releases/tag/v4.1.9
WEBhttps://huntr.dev/bounties/1c406a4e-15d0-4920-8495-731c48473ba4