PT-2023-27306 · Unknown · Social Media Skeleton

Zodiac0704 · Published 2023-08-18 · Updated 2023-08-23 · CVE-2023-40174

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Social media skeleton versions prior to 1.0.5

Description Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. This issue affects Social media skeleton, an uncompleted/framework social media project implemented using php, css, javascript, and html. The estimated number of potentially affected devices worldwide is not specified. There are no known real-world incidents where this issue was exploited.

Recommendations For Social media skeleton versions prior to 1.0.5, upgrade to version 1.0.5 to address the issue. As a temporary workaround, consider implementing proper session management and expiration mechanisms until the official patch is applied. Restrict access to sensitive areas of the application to minimize the risk of exploitation. Avoid using persistent sessions or implement a session timeout to reduce the risk.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-40174

GHSA-CR5C-GGWQ-G4HQ

Affected Products

Social Media Skeleton

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40174.json · Exploit
• https://github.com/fobybus/social-media-skeleton/commit/99738b2cc5efb6a5739161c931daa43f99431e5a · Patch
• https://osv.dev/vulnerability/CVE-2023-40174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-40174 · Security Note
• https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-cr5c-ggwq-g4hq · Note
• https://twitter.com/VulmonFeeds/status/1692699379574960562 · Twitter Post
• https://t.me/cibsecurity/68854 · Telegram Post
• https://t.me/cvenotify/56896 · Telegram Post