CVE-2023-40174

{"id": "CVE-2023-40174", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}]}, "published": "2023-08-18T22:15:11.423", "references": [{"url": "https://github.com/fobybus/social-media-skeleton/commit/99738b2cc5efb6a5739161c931daa43f99431e5a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/fobybus/social-media-skeleton/security/advisories/GHSA-cr5c-ggwq-g4hq", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage the lifecycle of a user's session. Social media skeleton releases prior to 1.0.5 did not properly limit manage user session lifecycles. This issue has been addressed in version 1.0.5 and users are advised to upgrade. There are no known workarounds for this vulnerability.\n\n"}, {"lang": "es", "value": "Social media skeleton es un proyecto/framework de social media sin completar implementado usando php, css, javascript y html. La expiraci\u00f3n de sesi\u00f3n insuficiente es una vulnerabilidad de seguridad de aplicaciones web que ocurre cuando una aplicaci\u00f3n web no gestiona adecuadamente el ciclo de vida de la sesi\u00f3n de un usuario. Las versiones de social media skeleton anteriores a la 1.0.5 no limitaban adecuadamente la gesti\u00f3n de los ciclos de vida de las sesiones de usuario. Este problema se ha solucionado en la versi\u00f3n 1.0.5 y se recomienda a los usuarios que actualicen. No se conocen soluciones para esta vulnerabilidad. "}], "lastModified": "2023-08-23T20:11:46.780", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fobybus:social-media-skeleton:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6B65799-63F2-4F3B-B6F8-BF9DD02EAB93", "versionEndExcluding": "1.0.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}