CVE-2020-23140

2020-11-0917:03:59

mitre

www.cve.org

microweber 1.1.18

insufficient session expiration

session expiration

password change

active session

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

51.5%

JSON

Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.

References

gist.github.com/virendratiwari03/bddafb3cd82dde8202bd056d340d3e36