Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.
References:GSA_kwCzR0hTQS12bTZwLTM1cnctM2Z4Y84AAt3H
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| packagist:aheinze/cockpit | < 2.2.0 | 2.2.0 | |
Affected Version RangesAll affected versions0.6.0, 0.6.1, 0.6.2, 0.7.0, 0.7.1, 0.7.2, 0.8.0, 0.8.1, 0.8.2, 0.8.3, 0.8.4, 0.8.6, 0.8.7, 0.8.8, 0.8.9, 0.8.10, 0.8.11, 0.9.0, 0.9.1, 0.9.2, 0.9.3, 0.10.0, 0.10.1, 0.10.2, 0.11.0, 0.11.1, 0.11.2, 0.12.0, 0.12.1, 0.12.2 All unaffected versions |
|||