Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-24444 BIT-silverstripe-2022-24444EUVD-2022-6019GHSA-c7q8-m4xw-c674

Hybridsessions does not expire session id on logout

Published Jun 28, 2022 · Updated Aug 3, 2024 · Assigned by mitre

Package: silverstripe/hybridsessions Ecosystem: Packagist

Description

Silverstripe silverstripe/framework through 4.10 allows Session Fixation.

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist silverstripe/hybridsessions >= 1.0.0, < 2.4.1 2.4.1 GHSA-c7q8-m4xw-c674
Packagist silverstripe/hybridsessions >= 2.5.0, < 2.5.1 2.5.1 GHSA-c7q8-m4xw-c674

References