In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
References
| Link | Resource |
|---|---|
| https://security.nozominetworks.com/NN-2023:8-01 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
28 May 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session. |
15 Aug 2023, 16:09
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.0 |
| CPE | cpe:2.3:a:nozominetworks:cmc:*:*:*:*:*:*:*:* cpe:2.3:a:nozominetworks:guardian:*:*:*:*:*:*:*:* |
|
| CWE | CWE-384 | |
| First Time |
Nozominetworks cmc
Nozominetworks guardian Nozominetworks |
|
| References | (MISC) https://security.nozominetworks.com/NN-2023:8-01 - Vendor Advisory |
09 Aug 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-09 08:15
Updated : 2024-05-28 13:15
NVD link : CVE-2023-24477
Mitre link : CVE-2023-24477
CVE.ORG link : CVE-2023-24477
JSON object : View
Products Affected
nozominetworks
- cmc
- guardian
CWE
CWE-384
Session Fixation