Vulnerability · Published Aug 9, 2023 · Assigned by Nozomi
CVE-2023-24477Session Fixation in Guardian/CMC before 22.6.2
High 7.0
In plain English
A high-severity session fixation in CMC from Nozomi Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Severity (CVSS 3.1)7.0High
Exploit odds (30 days)0.1%top 96.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In certain conditions, depending on timing and the usage of the Chrome web browser, Guardian/CMC versions before 22.6.2 do not always completely invalidate the user session upon logout. Thus an authenticated local attacker may gain acces to the original user's session.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Nozomi Networks | Guardian | 0 – before 22.6.2 |
| Nozomi Networks | CMC | 0 – before 22.6.2 |
Weakness: CWE-384 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H