CVE-2023-45659CWE-613

Session is not expiring after password reset in Engelsystem

Low · published October 16, 2023

CVSS v3.1
3.6
EPSS
0%
Percentile
15.8
In the wild
Unconfirmed
What it is

Engelsystem is a shift planning system for chaos events. If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
3.6 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00252 · 15.8th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2023-10-16T23:32Z
EPSS history
Timeline
  • 16 OCT 23:32Z
    Session is not expiring after password reset in Engelsystem
    cvelistv5