CVE-2022-24444

Packagist/silverstripe/hybridsessions CVE-2022-24444: medium 6.5, EPSS 0.90%

Hybridsessions does not expire session id on logout

Action: Upgrade silverstripe/hybridsessions to 2.4.1 or later.

composer require silverstripe/hybridsessions:2.4.1

composer require silverstripe/hybridsessions:2.5.1

Affected

Fixed versions

Sources

• osv: GHSA-c7q8-m4xw-c674
• https://nvd.nist.gov/vuln/detail/CVE-2022-24444
• https://docs.silverstripe.org/en/4/changelogs/4.10.1
• https://forum.silverstripe.org/c/releases
• https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/hybridsessions/CVE-2022-24444.yaml
• https://www.silverstripe.org/blog/tag/release
• https://www.silverstripe.org/download/security-releases
• https://www.silverstripe.org/download/security-releases/cve-2022-24444

CVE-2022-24444 · published 2022-06-29T22:09:53Z · modified 2024-02-21T05:24:37.445812Z · JSON