CVE-2022-3269: Session Fixation in ikus060/rdiffweb
First published: Fri Sep 23 2022(Updated: )
rdiffweb prior to 2.4.7 fails to invalidate session cookies on logout, leading to session fixation and allowing an attacker to access a users account. After logging in and logging out, the application continues to use the preauthentication cookies. The cookies remain the same after closing the browser and after password reset. The same cookies are reassigned for additional user logins which can lead to session fixation. An attacker can gain unauthorized access to the account of users who are using the same browser as long as a single session cookie persists on that browser once the attacker obtains a session cookie through another attack. This issue is patched in version 2.4.7. There are no known workarounds.
Credit: security@huntr.dev security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ikus-soft Rdiffweb | <2.4.7 | |
| pip/rdiffweb | <2.4.7 | 2.4.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ikus060/rdiffweb/commit/39e7dcd4a1f44d2a7bd92b79d78a800910b1b22b
- https://huntr.dev/bounties/67c25969-5e7a-4424-817e-e1a918f63cc6
- https://nvd.nist.gov/vuln/detail/CVE-2022-3269
- https://github.com/pypa/advisory-database/tree/main/vulns/rdiffweb/PYSEC-2022-290.yaml
- https://github.com/advisories/GHSA-j3q4-gmj4-mj95 (Advisory)
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-3269.
What is the severity of vulnerability CVE-2022-3269?
The severity of vulnerability CVE-2022-3269 is critical with a CVSS score of 9.8.
What is the affected software for vulnerability CVE-2022-3269?
The affected software for vulnerability CVE-2022-3269 is ikus-soft rdiffweb prior to version 2.4.7.
How can I fix vulnerability CVE-2022-3269?
To fix vulnerability CVE-2022-3269, update the ikus-soft rdiffweb software to version 2.4.7 or later.
Where can I find more information about vulnerability CVE-2022-3269?
More information about vulnerability CVE-2022-3269 can be found at the following references: [GitHub Commit](https://github.com/ikus060/rdiffweb/commit/39e7dcd4a1f44d2a7bd92b79d78a800910b1b22b), [Huntr Bounty](https://huntr.dev/bounties/67c25969-5e7a-4424-817e-e1a918f63cc6).
- collector/nvd-index
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-j3q4-gmj4-mj95
- alias/CVE-2022-3269
- agent/software-canonical-lookup
- agent/severity
- agent/softwarecombine
- agent/last-modified-date
- agent/references
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/tags
- collector/github-advisory
- vendor/ikus-soft
- canonical/ikus-soft rdiffweb
- package-manager/pip