CVE-2017-11667 - Insufficient Session Expiration

Severity

68%

Complexity

86%

Confidentiality

106%

OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session.

CVSS 3.0 Base Score 8.1. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Demo Examples

Insufficient Session Expiration

CWE-613

The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.


               </web-app>
                     </session-config><session-timeout>-1</session-timeout>

Overview

Type

OpenProject

First reported 7 years ago

2017-07-26 20:29:00

Last updated 5 years ago

2019-10-03 00:03:00

Affected Software

OpenProject 7.0.0

7.0.0

OpenProject 7.0.1

7.0.1

OpenProject 7.0.2

7.0.2

References

https://github.com/opf/openproject/commit/0fdd7578909d2ec50abc275fc4962e99566437ee

Patch

https://www.openproject.org/openproject-6-1-6-released-security-fix/

Vendor Advisory

https://www.openproject.org/openproject-7-0-3-released/