Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tZjc5LWY2NTctNDd3d800zA

Insufficient Session Expiration in Admidio

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.

Permalink: https://github.com/advisories/GHSA-mf79-f657-47ww
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tZjc5LWY2NTctNDd3d800zA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 8.2
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Identifiers: GHSA-mf79-f657-47ww, CVE-2022-0991
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-0991
• https://github.com/admidio/admidio/commit/e84e472ebe517e2ff5795c46dc10b5f49dc4d46a
• https://huntr.dev/bounties/1c406a4e-15d0-4920-8495-731c48473ba4
• https://github.com/Admidio/admidio/issues/1238
• https://github.com/Admidio/admidio/releases/tag/v4.1.9
• https://github.com/advisories/GHSA-mf79-f657-47ww

Repository: https://github.com/admidio/admidio
Blast Radius: 0.0

Affected Packages