exploitDog

CVE-2018-1127

Опубликовано: 08 мая 2018

Источник: redhat

CVSS3: 4.2

EPSS Низкий

Описание

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

Ссылки на источники

Дополнительная информация

Статус:

Low

Дефект:

CWE-613

https://bugzilla.redhat.com/show_bug.cgi?id=1575835tendrl-api: Improper cleanup of session token can allow attackers to hijack user sessions

EPSS

Процентиль: 63%

0.00456

Низкий

4.2 Medium

CVSS3

Связанные уязвимости

CVE-2018-1127

CVSS3: 4.2

nvd

больше 7 лет назад

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

GHSA-jwq3-h8rx-wcwj

CVSS3: 8.1

github

больше 3 лет назад

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

EPSS

Процентиль: 63%

0.00456

Низкий

4.2 Medium

CVSS3