Lucene search

NozomiCVELIST:CVE-2023-24477

HistoryAug 09, 2023 - 7:50 a.m.

CVE-2023-24477 Session Fixation in Guardian/CMC before 22.6.2

2023-08-0907:50:56

CWE-384

Nozomi

www.cve.org

cve-2023-24477

session fixation

guardian/cmc

user session

authentication

local attacker

chrome browser

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

5.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user’s session.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Guardian",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "lessThan": "22.6.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "CMC",
    "vendor": "Nozomi Networks",
    "versions": [
      {
        "lessThan": "22.6.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

security.nozominetworks.com/NN-2023:8-01

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

5.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

PASSIVE

CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2023-24477