CVE-2022-24444

MEDIUM6.5EPSS 0.27%

Hybridsessions does not expire session id on logout

發布日:2022/6/29修改日:2024/2/21

也稱為:GHSA-c7q8-m4xw-c674BIT-silverstripe-2022-24444

描述

When using the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk, unexpired SessionIDs of logged out users can still be used to make authenticated requests.

受影響套件(2)

Bitnami/silverstripefrom 0, < 2.4.0 | >= 2.5.0, <= 2.5.0
Packagist/silverstripe/hybridsessions>= 1.0.0, < 2.4.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

參考連結(9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-24444
WEBhttps://docs.silverstripe.org/en/4/changelogs/4.10.1
WEBhttps://docs.silverstripe.org/en/4/changelogs/4.10.1/
WEBhttps://forum.silverstripe.org/c/releases
WEBhttps://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/hybridsessions/CVE-2022-24444.yaml
WEBhttps://www.silverstripe.org/blog/tag/release
WEBhttps://www.silverstripe.org/download/security-releases
WEBhttps://www.silverstripe.org/download/security-releases/
WEBhttps://www.silverstripe.org/download/security-releases/cve-2022-24444