PT-2022-17387 · Unknown · Surveyking

Kpa1Onop · Published 2022-03-25 · Updated 2024-05-13 · CVE-2022-25590

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SurveyKing version 0.2.0

Description The issue allows attackers to login to the system and access data using the browser cache when the user exits the application, due to the retention of users' session cookies after logout.

Recommendations For SurveyKing version 0.2.0, consider clearing the browser cache after logout as a temporary workaround to minimize the risk of exploitation. Restrict access to sensitive data until a proper fix is implemented to prevent session cookie retention. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-25590

Affected Products

Surveyking

References · 7

• 🔥 https://github.com/javahuang/SurveyKing/issues/7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-25590 · Security Note
• https://osv.dev/vulnerability/CVE-2022-25590 · Vendor Advisory
• https://github.com/javahuang/SurveyKing · Note
• https://t.me/cvenotify/28209 · Telegram Post
• https://twitter.com/CVEnew/status/1790013808410521709 · Twitter Post
• http://surveyking.com · Note