GHSA-6293-2vg2-pmp5 CVE-2022-2064
Insufficient Session Expiration in NocoDB
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.22%
- Chance of exploitation in the next 30 days. Higher than 68.79% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
0.91.9- Upgrade nocodb to this version or later
Description
Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.9.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nocodb | < 0.91.9 |
0.91.9 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nocodb npm → 0.91.9
- npm
npm install nocodb@0.91.9- yarn
yarn add nocodb@0.91.9- pnpm
pnpm add nocodb@0.91.9
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hmcr-rmjq-47qr NocoDB: Server-Side Request Forgery via Spreadsheet Import Endpoint | Medium | Also affects nocodb |
| GHSA-h6vv-pcq8-7xm4 NocoDB: Server-Side Request Forgery via Base Migration URL | Medium | Also affects nocodb |
| GHSA-6mhr-74x2-98v9 NocoDB: Stored Cross-Site Scripting via Secure Attachment | Medium | Also affects nocodb |
| GHSA-r989-7g3j-wjhw NocoDB: Refresh Tokens Persist Through Password Recovery | Medium | Also affects nocodb |
| GHSA-gprh-27j3-g5h4 NocoDB: Server-Side Request Forgery via Spreadsheet Fetch URL | Medium | Also affects nocodb |
| GHSA-g72g-r7m4-9x4g NocoDB: OAuth Tokens Persist Through Security Events | Medium | Also affects nocodb |
| GHSA-xxpj-q764-9r6q NocoDB: Missing Ownership Check in MCP Attachment Read | Low | Also affects nocodb |
| GHSA-hj85-ph9q-78jg NocoDB: Stored Cross-Site Scripting via Form View Redirect URL | High | Also affects nocodb |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor