CVE-2020-35358

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7	Exploit Third Party Advisory
https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:domainmod:domainmod:4.15.0:*:*:*:*:*:*:*

History

21 Nov 2024, 05:27

Type	Values Removed	Values Added
References	~~() https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7 - Exploit, Third Party Advisory~~	() https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7 - Exploit, Third Party Advisory

Information

Published : 2021-03-15 12:15

Updated : 2024-11-21 05:27

NVD link : CVE-2020-35358

Mitre link : CVE-2020-35358

CVE.ORG link : CVE-2020-35358

JSON object : View

Products Affected

domainmod

domainmod

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2020-35358", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2021-03-15T12:15:12.523", "references": [{"url": "https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/anku-agar/0fec2ffd98308e550ce9b5d4b395d0d7", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality."}, {"lang": "es", "value": "DomainMOD versi\u00f3n domainmod-v4.15.0, est\u00e1 afectado por una vulnerabilidad de caducidad de sesi\u00f3n insuficiente. Al cambiar una contrase\u00f1a, tanto las sesiones que usan la contrase\u00f1a cambiada como las antiguas sesiones en cualquier otro navegador o dispositivo no expiran y permanecen activas. Este tipo de fallos suelen otorgar a atacantes un acceso no autorizado a algunos datos o funcionalidades del sistema"}], "lastModified": "2024-11-21T05:27:13.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:domainmod:domainmod:4.15.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BEA2BCA-5AE8-4AE4-B093-184C750F30F4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}