Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1tZjc5LWY2NTctNDd3d800zA

Insufficient Session Expiration in Admidio

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.

Permalink: https://github.com/advisories/GHSA-mf79-f657-47ww
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tZjc5LWY2NTctNDd3d800zA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago


CVSS Score: 8.2
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Identifiers: GHSA-mf79-f657-47ww, CVE-2022-0991
References: Repository: https://github.com/admidio/admidio
Blast Radius: 0.0

Affected Packages

packagist:admidio/admidio
Dependent packages: 1
Dependent repositories: 1
Downloads: 17 total
Affected Version Ranges: < 4.1.9
Fixed in: 4.1.9
All affected versions: 4.1.0, 4.1.3
All unaffected versions: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.2.6, 4.2.7, 4.2.8, 4.2.9, 4.2.10, 4.2.11, 4.2.12, 4.2.13, 4.2.14, 4.3.0, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7, 4.3.8, 4.3.9, 4.3.10, 4.3.11, 4.3.12