CVE-2022-2306: Insufficient Session Expiration

July 6, 2022 (updated July 15, 2022)

Old session tokens can be used to authenticate to the application and send authenticated requests.

References

github.com/advisories/GHSA-xv59-gc3r-rf92
github.com/heroiclabs/nakama/commit/ce8d3921e2acd44ef8b5e6edfe595b6df067b166
huntr.dev/bounties/35acf263-6db4-4310-ab27-4c3c3a53f796
nvd.nist.gov/vuln/detail/CVE-2022-2306

Detect and mitigate CVE-2022-2306 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →