GHSA-j3q4-gmj4-mj95

    Dashboard / Vulnerabilities / GHSA-j3q4-gmj4-mj95

    GHSA-j3q4-gmj4-mj95

    Published: 25 Sept 2022Last Modified: 25 Oct 2024

    Summary: rdiffweb vulnerable to account access via session fixation

    Details: rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the browser and after password reset. The same cookies are reassigned for additional user logins which can lead to session fixation. An attacker can gain unauthorized access to the account of users who are using the same browser as long as a single session cookie persists on that browser once the attacker obtains a session cookie through another attack. This issue is patched in version 2.4.7. There are no known workarounds.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-3269, https://github.com/ikus060/rdiffweb/commit/39e7dcd4a1f44d2a7bd92b79d78a800910b1b22b, https://github.com/ikus060/rdiffweb, https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-290.yaml, https://huntr.dev/bounties/67c25969-5e7a-4424-817e-e1a918f63cc6

    Affected packages

    Package

    Name: rdiffweb

    Purl: pkg:pypi/rdiffweb

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.4.7

    Affected versions

    0.10.0
    0.10.2
    0.10.3
    0.10.4
    0.10.5
    0.10.6
    0.10.7
    0.10.8
    0.10.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-j3q4-gmj4-mj95 | CVE-DB