8.8

CVE-2022-38369

Login check vulnerability by session Id

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apache ≫ Iotdb Version 0.13.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.11% 0.629
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

http://www.openwall.com/lists/oss-security/2022/09/05/1
Third Party Advisory
Mailing List
https://lists.apache.org/thread/7nk03ywvx3t3yjbcxzt7zy4nyc89y9b0
Vendor Advisory
Mailing List