CVE-2019-5638

HIGH Year: 2019
CVSS v3 Score
8.7
High
CVSS v2 Score
6.8
Medium
Weakness Type
CWE-613
View all →

Vulnerability Description

Rapid7 Nexpose versions 6.5.50 and prior suffer from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged on user. For example, if a user's password is changed by an administrator due to an otherwise unrelated credential leak, that user account's current session is still valid after the password change, potentially allowing the attacker who originally compromised the credential to remain logged in and able to cause further damage.

Related Vulnerabilities

CVE-2022-2713

HIGH
CVSS:8.6(High)

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.

CWE-6132022

CVE-2017-15653

HIGH
CVSS:8.8(High)

Improper administrator IP validation after his login in the HTTPd server in all current versions (<= 3.0.0.4.380.7743) of Asus asuswrt allows an unauthorized user to execute any action knowing adminis...

CWE-6132017

CVE-2017-6529

HIGH
CVSS:8.8(High)

An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

CWE-6132017

CVE-2018-1195

HIGH
CVSS:8.8(High)

In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access token...

CWE-6132018

CVE-2019-10229

HIGH
CVSS:8.8(High)

An issue was discovered in MailStore Server (and Service Provider Edition) 9.x through 11.x before 11.2.2. When the directory service (for synchronizing and authenticating users) is set to Generic LDA...

CWE-6132019

CVE-2019-12421

HIGH
CVSS:8.8(High)

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server ...

CWE-6132019