critical9.8
CVE-2022-2713
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
Impact
Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | aheinze/cockpit | < 2.2.0 | 2.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Agentejo | Cockpit | before 2.2.0 |