| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/persistent_login | ≥ 2.0.0, < 2.1.0≥ 2.1.0, < 2.2.0≥ 2.2.0, < 2.2.2< 1.8.0 | 2.1.02.2.02.2.21.8.0 |
| persistent login | ≥ 2.0.0, < 2.1.1≥ 2.2.0, < 2.2.2< 1.8.0 | 2.1.12.2.21.8.0 |
This module enables users to remain logged in separately from session timeouts.
The module doesn't sufficiently check a user's disabled status when validating cookies.
This vulnerability is mitigated by the fact that an attacker must have an unexpired cookie from a previous successful login.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free