CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

CVE-2024-22351 (GCVE-0-2024-22351)

Vulnerability from cvelistv5 – Published: 2025-04-23 22:15 – Updated: 2025-09-01 00:37
VLAI
Title
IBM InfoSphere Information Server session fixation
Summary
IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
ibm
References
URL Tags
https://www.ibm.com/support/pages/node/7229921 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM InfoSphere Information Server Affected: 11.7
    cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T12:56:02.437235Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-24T13:07:16.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "InfoSphere Information Server",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "11.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system."
            }
          ],
          "value": "IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-01T00:37:57.724Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7229921"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM InfoSphere Information Server session fixation",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-22351",
    "datePublished": "2025-04-23T22:15:49.142Z",
    "dateReserved": "2024-01-08T23:42:25.451Z",
    "dateUpdated": "2025-09-01T00:37:57.724Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-22358 (GCVE-0-2024-22358)

Vulnerability from cvelistv5 – Published: 2024-04-12 16:53 – Updated: 2024-08-01 22:43
VLAI
Title
IBM UrbanCode Deploy session fixation
Summary
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 280896.
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
ibm
References
Impacted products
Vendor Product Version
IBM UrbanCode Deploy Affected: 7.0 , ≤ 7.0.5.20 (semver)
Affected: 7.1 , ≤ 7.1.2.16 (semver)
Affected: 7.2 , ≤ 7.2.3.9 (semver)
Affected: 7.3 , ≤ 7.3.2.4 (semver)
Create a notification for this product.
IBM DevOps Deploy Affected: 8.0 , ≤ 8.0.0.1 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:ibm:devops_deploy:8.0.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "devops_deploy",
            "vendor": "ibm",
            "versions": [
              {
                "lessThanOrEqual": "8.0.0.1",
                "status": "affected",
                "version": "8.0.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:urbancode_deploy:7.0.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "urbancode_deploy",
            "vendor": "ibm",
            "versions": [
              {
                "lessThanOrEqual": "7.0.5.20",
                "status": "affected",
                "version": "7.0.0.0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "urbancode_deploy",
            "vendor": "ibm",
            "versions": [
              {
                "lessThanOrEqual": "7.1.2.16",
                "status": "affected",
                "version": "7.1",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:urbancode_deploy:7.2:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "urbancode_deploy",
            "vendor": "ibm",
            "versions": [
              {
                "lessThanOrEqual": "7.2.3.9",
                "status": "affected",
                "version": "7.2",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:ibm:urbancode_deploy:7.3:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "urbancode_deploy",
            "vendor": "ibm",
            "versions": [
              {
                "lessThanOrEqual": "7.3.2.4",
                "status": "affected",
                "version": "7.3",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22358",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-22T18:35:29.067961Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:52:37.641Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.839Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.ibm.com/support/pages/node/7148109"
          },
          {
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/280896"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "UrbanCode Deploy",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "7.0.5.20",
              "status": "affected",
              "version": "7.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.2.16",
              "status": "affected",
              "version": "7.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.3.9",
              "status": "affected",
              "version": "7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.3.2.4",
              "status": "affected",
              "version": "7.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "DevOps Deploy",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "8.0.0.1",
              "status": "affected",
              "version": "8.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy  8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  280896."
            }
          ],
          "value": "IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy  8.0 through 8.0.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.  IBM X-Force ID:  280896."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-12T16:53:43.381Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/7148109"
        },
        {
          "tags": [
            "vdb-entry"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/280896"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM UrbanCode Deploy session fixation",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-22358",
    "datePublished": "2024-04-12T16:53:43.381Z",
    "dateReserved": "2024-01-08T23:42:36.758Z",
    "dateUpdated": "2024-08-01T22:43:34.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-22389 (GCVE-0-2024-22389)

Vulnerability from cvelistv5 – Published: 2024-02-14 16:30 – Updated: 2024-08-16 18:11
VLAI
Title
BIG-IP iControl REST API Vulnerability
Summary
When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
f5
References
Impacted products
Vendor Product Version
F5 BIG-IP Affected: 17.1.0 , < 17.1.1 (custom)
Affected: 16.1.0 , < 16.1.4 (custom)
Affected: 15.1.0 , < 15.1.9 (custom)
Create a notification for this product.
Date Public
2024-02-14 15:00
Credits
F5
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.665Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://my.f5.com/manage/s/article/K32544615"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:f5:big-ip:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "big-ip",
            "vendor": "f5",
            "versions": [
              {
                "lessThan": "17.1.1",
                "status": "affected",
                "version": "17.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "16.1.4",
                "status": "affected",
                "version": "16.1.0",
                "versionType": "custom"
              },
              {
                "lessThan": "15.1.9",
                "status": "affected",
                "version": "15.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22389",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-16T18:10:00.553044Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-16T18:11:12.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "All Modules"
          ],
          "product": "BIG-IP",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "17.1.1",
              "status": "affected",
              "version": "17.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "16.1.4",
              "status": "affected",
              "version": "16.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "15.1.9",
              "status": "affected",
              "version": "15.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "F5"
        }
      ],
      "datePublic": "2024-02-14T15:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
            }
          ],
          "value": "When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the peer device.  \n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-14T16:30:19.797Z",
        "orgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
        "shortName": "f5"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://my.f5.com/manage/s/article/K32544615"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "BIG-IP iControl REST API Vulnerability",
      "x_generator": {
        "engine": "F5 SIRTBot v1.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9dacffd4-cb11-413f-8451-fbbfd4ddc0ab",
    "assignerShortName": "f5",
    "cveId": "CVE-2024-22389",
    "datePublished": "2024-02-14T16:30:19.797Z",
    "dateReserved": "2024-02-01T22:13:26.333Z",
    "dateUpdated": "2024-08-16T18:11:12.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-22403 (GCVE-0-2024-22403)

Vulnerability from cvelistv5 – Published: 2024-01-18 20:03 – Updated: 2025-06-17 21:19
VLAI
Title
OAuth2 authorization codes are valid indefinetly in Nextcloud server
Summary
Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability.
Severity
3 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T22:43:34.834Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36"
          },
          {
            "name": "https://github.com/nextcloud/server/pull/40766",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nextcloud/server/pull/40766"
          },
          {
            "name": "https://hackerone.com/reports/1784162",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1784162"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S6PN4GVJ5TZUC6WSG4X3ZA3AMPBEKNAX/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-22403",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-18T21:08:07.834767Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-17T21:19:22.193Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "security-advisories",
          "vendor": "nextcloud",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 28.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nextcloud server is a self hosted personal cloud system. In affected versions OAuth codes did not expire. When an attacker would get access to an authorization code they could authenticate at any time using the code. As of version 28.0.0 OAuth codes are invalidated after 10 minutes and will no longer be authenticated. To exploit this vulnerability an attacker would need to intercept an OAuth code from a user session. It is recommended that the Nextcloud Server is upgraded to 28.0.0. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-01T05:05:49.994Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wppc-f5g8-vx36"
        },
        {
          "name": "https://github.com/nextcloud/server/pull/40766",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nextcloud/server/pull/40766"
        },
        {
          "name": "https://hackerone.com/reports/1784162",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1784162"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S6PN4GVJ5TZUC6WSG4X3ZA3AMPBEKNAX/"
        }
      ],
      "source": {
        "advisory": "GHSA-wppc-f5g8-vx36",
        "discovery": "UNKNOWN"
      },
      "title": "OAuth2 authorization codes are valid indefinetly in Nextcloud server"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-22403",
    "datePublished": "2024-01-18T20:03:30.623Z",
    "dateReserved": "2024-01-10T15:09:55.548Z",
    "dateUpdated": "2025-06-17T21:19:22.193Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-23586 (GCVE-0-2024-23586)

Vulnerability from cvelistv5 – Published: 2024-09-27 21:20 – Updated: 2024-10-04 13:56
VLAI
Title
An insufficient session timeout vulnerability affects HCL Nomad server on Domino
Summary
HCL Nomad is susceptible to an insufficient session expiration vulnerability.   Under certain circumstances, an unauthenticated attacker could obtain old session information.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
HCL
References
Impacted products
Date Public
2024-09-27 21:13
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:hcltech:nomad_server_on_domino:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "nomad_server_on_domino",
            "vendor": "hcltech",
            "versions": [
              {
                "lessThan": "1.0.13",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-23586",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-04T13:53:43.919681Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-04T13:56:37.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Nomad server on Domino",
          "vendor": "HCL Software",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c1.0.13"
            }
          ]
        }
      ],
      "datePublic": "2024-09-27T21:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u0026nbsp; Under certain circumstances, an unauthenticated attacker could obtain old session information. \u0026nbsp;"
            }
          ],
          "value": "HCL Nomad is susceptible to an insufficient session expiration vulnerability. \u00a0 Under certain circumstances, an unauthenticated attacker could obtain old session information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL."
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-27T21:20:29.383Z",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "url": "https://support.hcltechsw.com/csm?id=kb_article\u0026sysparm_article=KB0115264"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "An insufficient session timeout vulnerability affects HCL Nomad server on Domino",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2024-23586",
    "datePublished": "2024-09-27T21:20:29.383Z",
    "dateReserved": "2024-01-18T07:30:10.662Z",
    "dateUpdated": "2024-10-04T13:56:37.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-25051 (GCVE-0-2024-25051)

Vulnerability from cvelistv5 – Published: 2025-04-02 14:57 – Updated: 2026-02-26 18:29
VLAI
Title
IBM Jazz Reporting Service insufficient session expiration
Summary
IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system.
Severity
6.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
ibm
References
URL Tags
https://www.ibm.com/support/pages/node/7229760 vendor-advisorypatch
Impacted products
Vendor Product Version
IBM Jazz Reporting Service Affected: 7.0.2
Affected: 7.0.3
    cpe:2.3:a:ibm:jazz_reporting_service:7.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:ibm:jazz_reporting_service:7.0.3:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25051",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-03T03:55:30.607528Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:29:01.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:jazz_reporting_service:7.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:jazz_reporting_service:7.0.3:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "Jazz Reporting Service",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "7.0.2"
            },
            {
              "status": "affected",
              "version": "7.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system."
            }
          ],
          "value": "IBM Jazz Reporting Service 7.0.2 and 7.0.3 does not invalidate session after logout which could allow an authenticated privileged user to impersonate another user on the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-01T10:14:53.515Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7229760"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM Jazz Reporting Service insufficient session expiration",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2024-25051",
    "datePublished": "2025-04-02T14:57:12.391Z",
    "dateReserved": "2024-02-03T14:49:33.094Z",
    "dateUpdated": "2026-02-26T18:29:01.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-25619 (GCVE-0-2024-25619)

Vulnerability from cvelistv5 – Published: 2024-02-14 20:50 – Updated: 2024-08-01 23:44
VLAI
Title
Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
Summary
Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn't actually fire, since `delete_all` doesn't trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application's Access Tokens are being "killed". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability.
Severity
3.1 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CWE
  • CWE-613 - Insufficient Session Expiration
  • CWE-672 - Operation on a Resource after Expiration or Release
Assigner
References
Impacted products
Vendor Product Version
mastodon mastodon Affected: >= 4.2.6, < 4.2.6
Affected: >= 4.1.0, < 4.1.14
Affected: >= 4.0.0, < 4.0.14
Affected: < 3.5.18
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25619",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-15T20:06:57.515329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:34:59.800Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:44:09.688Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x"
          },
          {
            "name": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mastodon",
          "vendor": "mastodon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.2.6, \u003c 4.2.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.14"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.14"
            },
            {
              "status": "affected",
              "version": "\u003c 3.5.18"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn\u0027t being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue listening to streaming after the application had been destroyed. Essentially this comes down to the fact that when Doorkeeper sets up the relationship between Applications and Access Tokens, it uses a `dependent: delete_all` configuration, which means the `after_commit` callback setup on `AccessTokenExtension` didn\u0027t actually fire, since `delete_all` doesn\u0027t trigger ActiveRecord callbacks. To mitigate, we need to add a `before_destroy` callback to `ApplicationExtension` which announces to streaming that all the Application\u0027s Access Tokens are being \"killed\". Impact should be negligible given the affected application had to be owned by the user. None the less this issue has been addressed in versions 4.2.6, 4.1.14, 4.0.14, and 3.5.18. Users are advised to upgrade. There are no known workaround for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-672",
              "description": "CWE-672: Operation on a Resource after Expiration or Release",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-14T20:50:10.809Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mastodon/mastodon/security/advisories/GHSA-7w3c-p9j8-mq3x"
        },
        {
          "name": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mastodon/mastodon/commit/68eaa804c9bafdc5f798e114e9ba00161425dd71"
        }
      ],
      "source": {
        "advisory": "GHSA-7w3c-p9j8-mq3x",
        "discovery": "UNKNOWN"
      },
      "title": "Destroying OAuth Applications doesn\u0027t notify Streaming of Access Tokens being destroyed in mastodon"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-25619",
    "datePublished": "2024-02-14T20:50:10.809Z",
    "dateReserved": "2024-02-08T22:26:33.511Z",
    "dateUpdated": "2024-08-01T23:44:09.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-25628 (GCVE-0-2024-25628)

Vulnerability from cvelistv5 – Published: 2024-02-16 20:23 – Updated: 2024-08-06 15:49
VLAI
Title
Insufficient Session Expiration in alf.io
Summary
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity
7.6 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
alfio-event alf.io Affected: < 2.0-M4-2402
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:44:09.877Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:alfio-event:alf.io:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "alf.io",
            "vendor": "alfio-event",
            "versions": [
              {
                "lessThan": "2.0-m4-2402",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25628",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T15:07:54.620721Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-06T15:49:15.967Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "alf.io",
          "vendor": "alfio-event",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0-M4-2402"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-02-16T20:23:44.693Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/alfio-event/alf.io/security/advisories/GHSA-8p6m-mm22-q893"
        }
      ],
      "source": {
        "advisory": "GHSA-8p6m-mm22-q893",
        "discovery": "UNKNOWN"
      },
      "title": "Insufficient Session Expiration in alf.io"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-25628",
    "datePublished": "2024-02-16T20:23:44.693Z",
    "dateReserved": "2024-02-08T22:26:33.512Z",
    "dateUpdated": "2024-08-06T15:49:15.967Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-25954 (GCVE-0-2024-25954)

Vulnerability from cvelistv5 – Published: 2024-03-28 18:38 – Updated: 2024-08-01 23:52
VLAI
Summary
Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
Dell PowerScale OneFS Affected: 9.5.0.0 , ≤ 9.5.0.7 (semver)
Affected: 9.6.1.0 , ≤ 9.7.0.0 (semver)
Affected: 9.7.0.0 , ≤ 9.7.0.1 (semver)
Create a notification for this product.
Date Public
2024-03-28 06:30
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:dell:powerscale_onefs:9.5.0.0:*:*:*:*:*:*:*",
              "cpe:2.3:a:dell:powerscale_onefs:9.6.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "powerscale_onefs",
            "vendor": "dell",
            "versions": [
              {
                "lessThan": "9.5.0.8",
                "status": "affected",
                "version": "9.5.0.0",
                "versionType": "custom"
              },
              {
                "lessThan": "9.7.0.2",
                "status": "affected",
                "version": "9.6.1.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-25954",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-29T14:12:52.552130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-01T14:55:29.197Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:52:06.326Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PowerScale OneFS",
          "vendor": "Dell",
          "versions": [
            {
              "lessThanOrEqual": "9.5.0.7",
              "status": "affected",
              "version": "9.5.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.7.0.0",
              "status": "affected",
              "version": "9.6.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "9.7.0.1",
              "status": "affected",
              "version": "9.7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2024-03-28T06:30:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service."
            }
          ],
          "value": "Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-28T18:38:09.593Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2024-25954",
    "datePublished": "2024-03-28T18:38:09.593Z",
    "dateReserved": "2024-02-13T05:32:19.479Z",
    "dateUpdated": "2024-08-01T23:52:06.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-27779 (GCVE-0-2024-27779)

Vulnerability from cvelistv5 – Published: 2025-07-18 07:58 – Updated: 2026-02-26 17:50
VLAI
Summary
An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin's session even after the admin user was deleted.
Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C
CWE
  • CWE-613 - Improper access control
Assigner
References
Impacted products
Vendor Product Version
Fortinet FortiSandbox Affected: 4.4.0 , ≤ 4.4.4 (semver)
Affected: 4.2.1 , ≤ 4.2.6 (semver)
Affected: 4.0.0 , ≤ 4.0.6 (semver)
Affected: 3.2.0 , ≤ 3.2.4 (semver)
    cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*
 Create a notification for this product.
Fortinet FortiIsolator Affected: 2.4.0 , ≤ 2.4.4 (semver)
Affected: 2.3.0 , ≤ 2.3.4 (semver)
Affected: 2.2.0
Affected: 2.1.0 , ≤ 2.1.2 (semver)
Affected: 2.0.0 , ≤ 2.0.1 (semver)
Affected: 1.2.0 , ≤ 1.2.2 (semver)
    cpe:2.3:a:fortinet:fortiisolator:2.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.1.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.1.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:2.0.0:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:fortinet:fortiisolator:1.2.0:*:*:*:*:*:*:*
 Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27779",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-19T03:55:14.366116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T17:50:28.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.6:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.5:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiSandbox",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "4.4.4",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.2.6",
              "status": "affected",
              "version": "4.2.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.0.6",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:fortinet:fortiisolator:2.4.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.4.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.4:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.3:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.1.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.1.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.1.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.0.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:2.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:1.2.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:1.2.1:*:*:*:*:*:*:*",
            "cpe:2.3:a:fortinet:fortiisolator:1.2.0:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "FortiIsolator",
          "vendor": "Fortinet",
          "versions": [
            {
              "lessThanOrEqual": "2.4.4",
              "status": "affected",
              "version": "2.4.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.3.4",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "2.2.0"
            },
            {
              "lessThanOrEqual": "2.1.2",
              "status": "affected",
              "version": "2.1.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "2.0.1",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.2.2",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An insufficient session expiration vulnerability [CWE-613] in FortiSandbox FortiSandbox version 4.4.4 and below, version 4.2.6 and below, 4.0 all versions, 3.2 all versions and FortiIsolator version 2.4 and below, 2.3 all versions, 2.2 all versions, 2.1 all versions, 2.0 all versions, 1.2 all versions may allow a remote attacker in possession of an admin session cookie to keep using that admin\u0027s session even after the admin user was deleted."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L/E:P/RL:X/RC:C",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Improper access control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-14T14:15:41.227Z",
        "orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
        "shortName": "fortinet"
      },
      "references": [
        {
          "name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-035",
          "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-035"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to FortiSandbox version 4.4.5 or above\nUpgrade to FortiSandbox version 4.2.7 or above\nUpgrade to FortiIsolator version 2.4.5 or above"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
    "assignerShortName": "fortinet",
    "cveId": "CVE-2024-27779",
    "datePublished": "2025-07-18T07:58:23.943Z",
    "dateReserved": "2024-02-26T14:46:31.334Z",
    "dateUpdated": "2026-02-26T17:50:28.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation

Phase: Implementation

Description:

  • Set sessions/credentials expiration date.

No CAPEC attack patterns related to this CWE.

Back to CWE stats page