CVE-2022-2713: Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration
Other sources
Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.
— GitHub
Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/aheinze/cockpitto a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade
cockpit-hq/cockpitto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2713?
The severity of CVE-2022-2713 is critical with a CVSS v3.1 score of 9.8.
What is the description of CVE-2022-2713?
CVE-2022-2713 refers to an Insufficient Session Expiration vulnerability in the GitHub repository cockpit-hq/cockpit prior to version 2.2.0.
Which software versions are affected by CVE-2022-2713?
The Agentejo Cockpit software versions up to but not including 2.2.0 are affected by CVE-2022-2713.
How can I fix the CVE-2022-2713 vulnerability?
To fix the CVE-2022-2713 vulnerability, upgrade to version 2.2.0 or later of the Agentejo Cockpit software.
Where can I find more information about CVE-2022-2713?
You can find more information about CVE-2022-2713 in the GitHub commit and the Huntr.dev bounty links: [GitHub Commit](https://github.com/cockpit-hq/cockpit/commit/dd8d0314912fa6517ebd2cc9939d9fafbe68731b) and [Huntr.dev Bounty](https://huntr.dev/bounties/3080fc96-75d7-4868-84de-9fc8c9b90290).