GitHub Advisoryadvisory · Packagist

GHSA-cmxc-9ghj-jp87 Insufficient Session Expiration in snipe/snipe-it

MEDIUM Published 2022-08-26 Modified 2022-09-08 Official page ↗

Aliases: CVE-2022-2997
Ecosystem: Packagist
Packages: snipe/snipe-it
Severity: Moderate
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses: CWE-384
Reviewed: 2022-08-30

Affected packages

• Packagist snipe/snipe-it: < 6.0.10 → fixed in 6.0.10

Description

Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.

Related

Alias · CVE (1)

CVE-2022-2997 Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10. vulnerability

Weakness · CWE (1)

CWE-384 Session Fixation weakness

References