CVE-2022-22113: DayByDay CRM - Insufficient Session Expiration after Password Change
In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-22113?
CVE-2022-22113 is a vulnerability in DayByDay CRM versions 2.2.0 through 2.2.1 that allows users to retain access to the application after changing their password.
How severe is CVE-2022-22113?
CVE-2022-22113 has a severity rating of 8.8, which is classified as high.
How does CVE-2022-22113 affect DayByDay CRM?
CVE-2022-22113 affects DayByDay CRM versions 2.2.0 through 2.2.1, allowing users to maintain access to the application even after changing their password.
How can I fix CVE-2022-22113 in DayByDay CRM?
To fix CVE-2022-22113, update your DayByDay CRM installation to a version higher than 2.2.1.
Is there any additional information about CVE-2022-22113?
For more information about CVE-2022-22113, you can refer to the following sources: [GitHub](https://github.com/Bottelet/DaybydayCRM/blob/master/config/session.php#L32), [WhiteSource Software](https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-22113).