CVE-2024-25718

Katalog CVE

CVSS 9.8 · Critical EPSS 0,66%

Kerentanan Insufficient Session Expiration pada dropbox samly. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.

Rincian

Terbit di NVD

11 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-613: Insufficient Session Expiration
CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,66% peluang dieksploitasi; lebih tinggi dari 50,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://diff.hex.pm/diff/samly/1.3.0..1.4.0 patch
• https://github.com/dropbox/samly/pull/13 patch
• https://github.com/dropbox/samly/pull/13/commits/812b5c3ad076dc9c9334c1a560c8e6470607d1eb patch
• https://github.com/dropbox/samly product
• https://github.com/handnot2/samly product
• https://hex.pm/packages/samly release notes