PT-2023-19632 · Google · Google Chrome

Published 2023-08-09 · Updated 2024-09-20 · CVE-2023-24477

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Guardian/CMC versions prior to 22.6.2

Description The issue arises under certain conditions, influenced by timing and the usage of the Chrome web browser, where the user session is not always fully invalidated upon logout. This allows an authenticated local attacker to potentially gain access to the original user's session.

Recommendations For versions prior to 22.6.2, update to version 22.6.2 or later to resolve the issue. As a temporary workaround, consider implementing additional logout validation mechanisms to ensure user sessions are properly terminated. Restrict access to sensitive information and resources to minimize the risk of exploitation until the update can be applied.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-24477

Affected Products

Google Chrome

References · 8

• https://security.nozominetworks.com/NN-2023:8-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-24477 · Security Note
• https://osv.dev/vulnerability/CVE-2023-24477 · Vendor Advisory
• https://t.me/cvenotify/56062 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1689228096312860672 · Twitter Post
• https://t.me/cvenotify/95413 · Telegram Post
• https://t.me/cvenotify/81146 · Telegram Post
• https://t.me/cibsecurity/68071 · Telegram Post