| Package | Affected versions | Patched versions |
|---|---|---|
| cmc | < 22.6.2 | 22.6.2 |
| guardian | < 22.6.2 | 22.6.2 |
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free