Insufficient Session Expiration in Admidio
Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-0991US | high7.1 | — | ||
Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/Admidio/admidioPACKAGE
- https://github.com/Admidio/admidio/issues/1238WEB
- https://github.com/Admidio/admidio/releases/tag/v4.1.9WEB
- https://github.com/admidio/admidio/commit/e84e472ebe517e2ff5795c46dc10b5f49dc4d46aWEB
- https://huntr.dev/bounties/1c406a4e-15d0-4920-8495-731c48473ba4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-0991ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan