CVE-2023-40174: falha de média gravidade em fobybus social-media-skeleton
Insufficient Session Expiration in fobybus/social-media-skeleton
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.5%
Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
fobybus · social-media-skeletonCVEs relacionadas — fobybus social-media-skeleton
No mesmo produto, das mais perigosas para as menos.
CVE-2023-39344CRITICALsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEEPSS 1.5%CVE-2023-40173HIGHUnsalted passwords in fobybus/social-media-skeletonEPSS 0.7%CVE-2023-39518MEDIUMsocial-media-skeleton stored Cross-site Scripting vulnerabilityEPSS 0.5%CVE-2023-40172MEDIUMCross-Site Request Forgery (CSRF) in fobybus/social-media-skeletonEPSS 0.3%