Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration

CRITICO 9.8CVE-2022-2713 · GHSA-vm6p-35rw-3fxc · Published 08/08/2022 · updated 17/06/2026

In breve

CVE-2022-2713 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda aheinze/cockpit, cockpit (agentejo).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.3%, superiore al 69.4% delle vulnerabilità.
Correzione: aggiornare a 2.2.0 o successiva.

Package	Affected versions	Patched versions
aheinze/cockpit Packagist	`< 2.2.0`	`2.2.0`
cockpit agentejo	`< 2.2.0`	`2.2.0`

Description

Cockpit before version 2.2.0 is vulnerable to Insufficient Session Expiration. The application does not validate requests after password changes, allowing a user to change their account details even after an admin changes their password.

NVD description

Insufficient Session Expiration in GitHub repository cockpit-hq/cockpit prior to 2.2.0.

References

nvd.nist.gov/vuln/detail/CVE-2022-2713 · ADVISORY
cockpit-hq/cockpit commit dd8d031 · WEB
cockpit-hq/cockpit · PACKAGE
huntr.dev/bounties/3080fc96-75d7-4868-84de-9fc8c9b90290 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free