Monday, January 24, 2022

CVE-2022-22122

In Mattermost Focalboard, versions prior to v0.7.5, v0.8.4, v0.9.5, v0.10.1 and v0.11.0-rc1; as used respectively in Mattermost, versions prior to v5.37.6, v5.39.3, v6.0.4, v6.1.1 and v6.2.0, are vulnerable to Insufficient Session Expiration. When a user initiates a logout, their session is not invalidated properly. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, to completely take over a victim account. (CVSS:7.5) (Last Update:2022-01-24)
http://dlvr.it/SHkrf6

No comments:

Post a Comment

Black swans events are shaping the cybersecurity present and future - VentureBeat

Black swans events are shaping the cybersecurity present and future  VentureBeat http://dlvr.it/ShfHB2