CVE-2024-25718
11.02.2024, 05:15
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.Enginsight
| Vendor | Product | Version |
|---|---|---|
| dropbox | samly | 𝑥 < 1.4.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-613 - Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
- CWE-400 - Uncontrolled Resource ConsumptionThe software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
References