PT-2023-31050 · Unknown · Cosmos-Server

Vncloudsco · Publicado 2023-11-29 · Atualizado 2025-04-11 · CVE-2023-49091

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cosmos-server versions prior to 0.13.1

Description The issue arises from the authorization header used for user login remaining valid and not expiring after log out, allowing an attacker to use the token to gain unauthorized access to the application or system even after the user has logged out.

Recommendations For versions prior to 0.13.1, update to version 0.13.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application until the update can be applied.

Exploit

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2023-49091

GHSA-HPVM-X7M8-3C6X

Produtos afetados

Cosmos-Server

Referências · 8

• 🔥 https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-hpvm-x7m8-3c6x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49091.json · Exploit
• https://github.com/azukaar/Cosmos-Server/commit/7a3fdfb467bd4d1f8333e3e1f3c3f5fca0b69cd7 · Correção
• https://t.me/cvenotify/108146 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49091 · Aviso do Fabricante
• https://t.me/cvenotify/62897 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-49091 · Nota de Segurança
• https://t.me/cvenotify/118869 · Publicação no Telegram