snipe/snipe-it · Security
Insufficient Session Expiration in snipe/snipe-it
- GHSA ID
- GHSA-cmxc-9ghj-jp87
- CVE ID
- CVE-2022-2997
- Severity
- medium
- Published
- Updated
- CVSS
- 4.6 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
- CVSS v3
- 4.6 · CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Description
Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change.
CWEs
- CWE-384 · Session Fixation