PT-2023-31050 · Unknown · Cosmos-Server

Vncloudsco · Published 2023-11-29 · Updated 2025-04-11 · CVE-2023-49091

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cosmos-server versions prior to 0.13.1

Description The issue arises from the authorization header used for user login remaining valid and not expiring after log out, allowing an attacker to use the token to gain unauthorized access to the application or system even after the user has logged out.

Recommendations For versions prior to 0.13.1, update to version 0.13.1 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application until the update can be applied.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2023-49091

GHSA-HPVM-X7M8-3C6X

Affected Products

Cosmos-Server

References · 8

• 🔥 https://github.com/azukaar/Cosmos-Server/security/advisories/GHSA-hpvm-x7m8-3c6x · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/49xxx/CVE-2023-49091.json · Exploit
• https://github.com/azukaar/Cosmos-Server/commit/7a3fdfb467bd4d1f8333e3e1f3c3f5fca0b69cd7 · Patch
• https://osv.dev/vulnerability/CVE-2023-49091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49091 · Security Note
• https://t.me/cvenotify/108146 · Telegram Post
• https://t.me/cvenotify/62897 · Telegram Post
• https://t.me/cvenotify/118869 · Telegram Post