CVE-2022-23063: Shopizer - Insufficient Session Expiration
In Shopizer versions 2.3.0 to 3.0.1 are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-23063?
CVE-2022-23063 is a vulnerability in Shopizer versions 2.3.0 to 3.0.1 that allows a user to retain access to the application even after changing their password.
What is the severity of CVE-2022-23063?
CVE-2022-23063 has a severity rating of 8.8 (high).
How does CVE-2022-23063 affect Shopizer?
CVE-2022-23063 affects Shopizer versions 2.3.0 to 3.0.1 by allowing users to maintain access to the application even after changing their password.
How can I fix CVE-2022-23063?
To fix CVE-2022-23063, it is recommended to update Shopizer to a version that includes the necessary security patches or consult the official documentation for a workaround.
Where can I find more information about CVE-2022-23063?
More information about CVE-2022-23063 can be found at the following references: [GitHub](https://github.com/shopizer-ecommerce/shopizer/blob/3.0.1/sm-shop/src/main/java/com/salesmanager/shop/store/api/v1/customer/AuthenticateCustomerApi.java#L213-L237) and [WhiteSource Software](https://www.whitesourcesoftware.com/vulnerability-database/CVE-2022-23063).