GHSA-vm6p-35rw-3fxc

Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-2713

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	aheinze/cockpit	< 2.2.0	2.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-2713 advisory
https://github.com/cockpit-hq/cockpit/commit/dd8d0314912fa6517ebd2cc9939d9fafbe68731b web
https://github.com/cockpit-hq/cockpit package
https://huntr.dev/bounties/3080fc96-75d7-4868-84de-9fc8c9b90290 web