Lucene search
Veracode Vulnerability DatabaseVERACODE:36267HistoryJul 06, 2022 - 6:19 a.m.
Insecure Session
2022-07-0606:19:52
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
9
0.001 Low
EPSS
Percentile
30.3%
github.com/heroiclabs/nakama is vulnerable to insecure session. The vulnerability exists because session tokens on logout are not properly validated which allows an attacker to send requests with old tokens to authenticate to the application.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/heroiclabs/nakama | le | v3.12.0 | |
| github.com/heroiclabs/nakama | le | v3.12.0 |
References
github.com/advisories/GHSA-xv59-gc3r-rf92
github.com/heroiclabs/nakama/blob/master/console/ui/src/app/authentication.service.ts#L82-L86
github.com/heroiclabs/nakama/commit/ce8d3921e2acd44ef8b5e6edfe595b6df067b166
github.com/heroiclabs/nakama/pull/875
huntr.dev/bounties/35acf263-6db4-4310-ab27-4c3c3a53f796
huntr.dev/bounties/35acf263-6db4-4310-ab27-4c3c3a53f796/
Related
osv
osv
CVE-2022-2306
2022-07-05 09:15:08
Insufficient Session Expiration in Nakama
2022-07-06 00:00:30
prion
prion
Design/Logic Flaw
2022-07-05 09:15:00
huntr
huntr
Session tokens are not invalidated on logout
2022-05-24 14:00:27
github
github
Insufficient Session Expiration in Nakama
2022-07-06 00:00:30
cve
cve
CVE-2022-2306
2022-07-05 09:15:08
cvelist
cvelist
CVE-2022-2306 Insufficient Session Expiration in heroiclabs/nakama
2022-07-05 08:30:11
nvd
nvd
CVE-2022-2306
2022-07-05 09:15:08