CVE-2023-24477CWE-384

Session Fixation in Guardian/CMC before 22.6.2

Medium · published August 9, 2023

CVSS v4.0
5.4
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.

The record
Technical detail
CVSS v4.0
5.4 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-384 · Session Fixation
Published
2023-08-09T07:50Z
EPSS history
Timeline
  • 09 AUG 07:50Z
    Session Fixation in Guardian/CMC before 22.6.2
    cvelistv5