CVE-2022-25590

SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://surveyking.com	Product
https://github.com/javahuang/SurveyKing	Product Third Party Advisory
https://github.com/javahuang/SurveyKing/issues/7	Exploit Issue Tracking Third Party Advisory
http://surveyking.com	Product
https://github.com/javahuang/SurveyKing	Product Third Party Advisory
https://github.com/javahuang/SurveyKing/issues/7	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:surveyking:surveyking:0.2.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-25 19:15

Updated : 2024-11-21 06:52

NVD link : CVE-2022-25590

Mitre link : CVE-2022-25590

CVE.ORG link : CVE-2022-25590

JSON object : View

Products Affected

surveyking

surveyking

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2022-25590", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2022-03-25T19:15:10.637", "references": [{"url": "http://surveyking.com", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/javahuang/SurveyKing", "tags": ["Product", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/javahuang/SurveyKing/issues/7", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://surveyking.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/javahuang/SurveyKing", "tags": ["Product", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/javahuang/SurveyKing/issues/7", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application."}, {"lang": "es", "value": "Se ha detectado que SurveyKing versi\u00f3n v0.2.0, retiene las cookies de sesi\u00f3n de los usuarios despu\u00e9s de cerrar la sesi\u00f3n, lo que permite a atacantes entrar en el sistema y acceder a los datos usando la cach\u00e9 del navegador cuando el usuario sale de la aplicaci\u00f3n"}], "lastModified": "2024-11-21T06:52:23.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:surveyking:surveyking:0.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7ECE4D5-2E50-459A-B3E8-F38E7081EA99"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}