GHSA-c7q8-m4xw-c674
Hybridsessions does not expire session id on logout
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | silverstripe/hybridsessions | >= 1.0.0, < 2.4.1 | 2.4.1 |
| Packagist | silverstripe/hybridsessions | >= 2.5.0, < 2.5.1 | 2.5.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
When using the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk, unexpired SessionIDs of logged out users can still be used to make authenticated requests.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-24444
- https://docs.silverstripe.org/en/4/changelogs/4.10.1
- https://forum.silverstripe.org/c/releases
- https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/hybridsessions/CVE-2022-24444.yaml
- https://www.silverstripe.org/blog/tag/release
- https://www.silverstripe.org/download/security-releases
- https://www.silverstripe.org/download/security-releases/cve-2022-24444