CRITICAL🇵🇱 Wersja polska

CVE-2020-35358

CVSS 9.8v3.1pub. 2021-03-15upd. 2024-11-21

DomainMOD domainmod-v4.15.0 is affected by an insufficient session expiration vulnerability. On changing a password, both sessions using the changed password and old sessions in any other browser or device do not expire and remain active. Such flaws frequently give attackers unauthorized access to some system data or functionality.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Domainmod

    APP
    Domainmod
    4.15.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-12735CRITICAL9.8PL ✓same product

DomainMOD: niewystarczająca entropia w resetowaniu hasła umożliwia przejęcie konta

CVE-2019-9080HIGH7.5same product

DomainMOD before 4.14.0 uses MD5 without a salt for password storage.

CVE-2019-1010096HIGH8.8same product

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerabil...

CVE-2019-1010094HIGH8.8same product

domainmod v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerabil...

CVE-2019-1010095HIGH8.8same product

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: There is a CSRF vulnerabil...