CVE-2017-11667

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session...

CVE-2017-11667: Insufficient Session Expiration

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session...

PT-2017-12160

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 6.1.6 OpenProject versions 7.x prior to 7.0.3 Description The issue concerns the mishandling of session expiry, allowing remote attackers to perform API requests indefinitely by leveraging a hijacked session...