GitHub Advisoryadvisory · Packagist

GHSA-c7q8-m4xw-c674 Hybridsessions does not expire session id on logout

MEDIUM Published 2022-06-29 Modified 2022-07-14 Official page ↗
Aliases
CVE-2022-24444
Ecosystem
Packagist
Packages
silverstripe/hybridsessions
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-384
Reviewed
2022-06-29

Affected packages

• Packagist silverstripe/hybridsessions: >= 1.0.0, < 2.4.1 → fixed in 2.4.1 • Packagist silverstripe/hybridsessions: >= 2.5.0, < 2.5.1 → fixed in 2.5.1

Description

When using the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk, unexpired SessionIDs of logged out users can still be used to make authenticated requests.

Related

Alias · CVE (1)

  • CVE-2022-24444 Silverstripe silverstripe/framework through 4.10 allows Session Fixation. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References