GitHub Advisoryadvisory · Packagist

GHSA-mf79-f657-47ww Insufficient Session Expiration in Admidio

HIGH Published 2022-03-20 Modified 2022-03-28 Official page ↗
Aliases
CVE-2022-0991
Ecosystem
Packagist
Packages
admidio/admidio
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L
Weaknesses
CWE-613
Reviewed
2022-03-28

Affected packages

• Packagist admidio/admidio: < 4.1.9 → fixed in 4.1.9

Description

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2022-0991 Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. vulnerability

References