Описание
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
EPSS
Процентиль: 8%
0.00188
Низкий
6.8 Medium
CVSS3
Дефекты
CWE-613
Связанные уязвимости
CVSS3: 6.8
debian
2 дня назад
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all ...
CVSS3: 6.8
github
2 дня назад
Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cookie can maintain access to user accounts even after the associated user changes their password.
EPSS
Процентиль: 8%
0.00188
Низкий
6.8 Medium
CVSS3
Дефекты
CWE-613