Insufficient Session Expiration
CVE-2022-3867
Summary
HashiCorp Nomad and Nomad Enterprise 1.4.x prior to 1.4.2 event stream subscribers using a token with TTL receive updates until token garbage is collected.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- LOW
- LOW
- NONE
CWE-613 - Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
References
Advisory Timeline
- Published